https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T15:51:42.622967+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-292301 EUVD-2026-292301 2026-10-06T15:51:42.680242+00:00 EUVD-2026-292301 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40885 fkie_cve-2026-40885 2026-10-06T15:51:42.680282+00:00

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to .goshs-protected folders are logged before authorization is enforced, and the collaborator websocket broadcasts raw request headers, including Authorization. An unauthenticated observer can capture a victim's folder-specific basic-auth header and replay it to read, upload, overwrite, and delete files inside the protected subtree. This vulnerability is fixed in 2.0.0-beta.6.

 https://cve.radiocsirt.org/vuln/ghsa-7h3j-592v-jcrp GHSA-7h3j-592v-jcrp — goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access 2026-10-06T15:51:42.680318+00:00

Affected: Go: github.com/patrickhener/goshs/v2

### Summary goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to `.goshs`-protected folders are logged before authorization is enforced, and the collaborator websocket broadcasts raw request headers, including `Authorization`. An unauthenticated observer can capture a victim's folder-specific basic-auth header and replay it to read, upload, overwrite, and delete files inside the protected subtree. I reproduced this on `v2.0.0-beta.5`, the latest supported release as of April 10, 2026.

### Details The main web UI and collaborator websocket stay public when goshs is started without global `-b user:pass` authentication:

- `httpserver/server.go:72-85` only installs `BasicAuthMiddleware()` when a global username or password is configured

The vulnerable request is logged before `.goshs` authorization is enforced:

- `httpserver/handler.go:277-279` calls `emitCollabEvent()` and `logger.LogRequest()` before the protected file is passed into ACL enforcement - `httpserver/handler.go:291-309` performs folder-level `.goshs` authentication later in `applyCustomAuth()`

The collaborator pipeline copies and broadcasts every request header:

- `httpserver/collaborator.go:22-46` flattens all request headers, including `Authorization`, into the websocket event and sends them to the hub - `ws/hub.go:77-84` fans the event out live to all connected websocket clients - `ws/hub.go:116-122` replays up to 20…