https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 12:11:21 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292301 EUVD-2026-292301 https://cve.radiocsirt.org/vuln/euvd-2026-292301 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40885 <p>goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to .goshs-protected folders are logged before authorization is enforced, and the collaborator websocket broadcasts raw request headers, including Authorization. An unauthenticated observer can capture a victim&#39;s folder-specific basic-auth header and replay it to read, upload, overwrite, and delete files inside the protected subtree. This vulnerability is fixed in 2.0.0-beta.6.</p> <p>goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to .goshs-protected folders are logged before authorization is enforced, and the collaborator websocket broadcasts raw request headers, including Authorization. An unauthenticated observer can capture a victim&#39;s folder-specific basic-auth header and replay it to read, upload, overwrite, and delete files inside the protected subtree. This vulnerability is fixed in 2.0.0-beta.6.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40885 https://cve.radiocsirt.org/vuln/ghsa-7h3j-592v-jcrp <p><strong>Affected:</strong> Go: github.com/patrickhener/goshs/v2</p> <p>### Summary goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to `.goshs`-protected folders are logged before authorization is enforced, and the collaborator websocket broadcasts raw request headers, including `Authorization`. An unauthenticated observer can capture a victim&#39;s folder-specific basic-auth header and replay it to read, upload, overwrite, and delete files inside the protected subtree. I reproduced this on `v2.0.0-beta.5`, the latest supported release as of April 10, 2026.</p> <p>### Details The main web UI and collaborator websocket stay public when goshs is started without global `-b user:pass` authentication:</p> <p>- `httpserver/server.go:72-85` only installs `BasicAuthMiddleware()` when a global username or password is configured</p> <p>The vulnerable request is logged before `.goshs` authorization is enforced:</p> <p>- `httpserver/handler.go:277-279` calls `emitCollabEvent()` and `logger.LogRequest()` before the protected file is passed into ACL enforcement - `httpserver/handler.go:291-309` performs folder-level `.goshs` authentication later in `applyCustomAuth()`</p> <p>The collaborator pipeline copies and broadcasts every request header:</p> <p>- `httpserver/collaborator.go:22-46` flattens all request headers, including `Authorization`, into the websocket event and sends them to the hub - `ws/hub.go:77-84` fans the event out live to all connected websocket clients - `ws/hub.go:116-122` replays up to 20…</p> <p><strong>Affected:</strong> Go: github.com/patrickhener/goshs/v2</p> <p>### Summary goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to `.goshs`-protected folders are logged before authorization is enforced, and the collaborator websocket broadcasts raw request headers, including `Authorization`. An unauthenticated observer can capture a victim&#39;s folder-specific basic-auth header and replay it to read, upload, overwrite, and delete files inside the protected subtree. I reproduced this on `v2.0.0-beta.5`, the latest supported release as of April 10, 2026.</p> <p>### Details The main web UI and collaborator websocket stay public when goshs is started without global `-b user:pass` authentication:</p> <p>- `httpserver/server.go:72-85` only installs `BasicAuthMiddleware()` when a global username or password is configured</p> <p>The vulnerable request is logged before `.goshs` authorization is enforced:</p> <p>- `httpserver/handler.go:277-279` calls `emitCollabEvent()` and `logger.LogRequest()` before the protected file is passed into ACL enforcement - `httpserver/handler.go:291-309` performs folder-level `.goshs` authentication later in `applyCustomAuth()`</p> <p>The collaborator pipeline copies and broadcasts every request header:</p> <p>- `httpserver/collaborator.go:22-46` flattens all request headers, including `Authorization`, into the websocket event and sends them to the hub - `ws/hub.go:77-84` fans the event out live to all connected websocket clients - `ws/hub.go:116-122` replays up to 20…</p> https://cve.radiocsirt.org/vuln/ghsa-7h3j-592v-jcrp