EUVD-2026-280198

fkie_cve-2026-34581

goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.0-beta.2.

GHSA-jgfx-74g2-9r6g — goshs has Auth Bypass via Share Token

Affected: Go: github.com/patrickhener/goshs

### Summary When using the `Share Token` it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec.

### Details

The `BasicAuthMiddleware` checks for a `?token=` parameter **before** checking credentials. If the token exists in `SharedLinks`, the request passes through with **no auth check at all**. The handler then processes all query parameters — including `?ws` (WebSocket) which has higher priority than `?token`.

```go // middleware.go:22-30 — token check runs FIRST token := r.URL.Query().Get("token") if token != "" { _, ok := fs.SharedLinks[token] if ok { next.ServeHTTP(w, r) // Full auth bypass return } } // ... normal auth checks never reached ```

A share token is designed for **single-file, time-limited downloads**. But the middleware bypass grants access to everything — directory listing, file deletion, clipboard, WebSocket, and CLI command execution.

**1. Create a webroot:**

```bash mkdir -p /tmp/goshs-webroot echo "shareable file" > /tmp/goshs-webroot/shareable.txt ```

**2. Start goshs with auth + TLS + CLI mode:**

```bash /tmp/goshs-test -d /tmp/goshs-webroot -b 'admin:password' -s -ss -c -p 8000 ```

> CLI mode requires auth (`-b`) and TLS (`-s -ss`). This is the documented usage — not a weakened config.

**3. Verify authentication is required:**

```bash curl -sk https://localhost:8000/ Not authorized ```

**4. As a legitimate user, create a share link:**

```bash curl…

Most recent entries from all

EUVD-2026-280198

fkie_cve-2026-34581

GHSA-jgfx-74g2-9r6g — goshs has Auth Bypass via Share Token