https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 01:31:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-342321 EUVD-2026-342321 https://cve.radiocsirt.org/vuln/euvd-2026-342321 https://cve.radiocsirt.org/vuln/fkie_cve-2026-62325 <p>goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != &#34;&#34; &amp;&amp; Password != &#34;&#34;, so running goshs with -b &#39;admin:&#39; -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.</p> <p>goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != &#34;&#34; &amp;&amp; Password != &#34;&#34;, so running goshs with -b &#39;admin:&#39; -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-62325 https://cve.radiocsirt.org/vuln/ghsa-rjrw-mjq6-hpmm <p><strong>Affected:</strong> Go: github.com/patrickhener/goshs/v2, Go: goshs.de/goshs/v2</p> <p>## Summary</p> <p>Start goshs v2.1.3 with `-b &#39;admin:&#39; -sftp`. No `-fkf`. SFTP accepts connections without password. CVE-2026-40884 blocks the empty-username variant (`-b &#39;:pass&#39;`). The empty-password variant bypasses that fix.</p> <p>## CVE-2026-40884</p> <p>**CVE-2026-40884** (GHSA-c29w-qq4m-2gcv, Apr 13 2026) reported the empty-username case: `-b &#39;:pass&#39;` with `-sftp`. `sftpserver.go:85` uses `&amp;&amp;`:</p> <p>```go if s.Username != &#34;&#34; &amp;&amp; s.Password != &#34;&#34; { sshServer.PasswordHandler = func(ctx ssh.Context, password string) bool { return subtle.ConstantTimeCompare([]byte(ctx.User()), []byte(s.Username)) == 1 &amp;&amp; subtle.ConstantTimeCompare([]byte(password), []byte(s.Password)) == 1 } } ```</p> <p>Empty username → `Username != &#34;&#34;` false → `PasswordHandler` nil. No `-fkf` means `PublicKeyHandler` also nil. gliderlabs/ssh sees all handlers nil and sets `NoClientAuth = true`. Unauthenticated access.</p> <p>Patrickhener fixed it with a sanity check at `sanity/checks.go:114-118`:</p> <p>```go if opts.FTP &amp;&amp; opts.FTPSFTPMode &amp;&amp; strings.HasPrefix(opts.BasicAuth, &#34;:&#34;) { logger.Fatal(&#34;When using SFTP with password authentication, the username cannot be empty. ...&#34;) } ```</p> <p>`HasPrefix(&#34;:&#34;)` catches empty username. It does not catch empty password.</p> <p>## Empty Password Bypass</p> <p>Same `&amp;&amp;` at `sftpserver.go:85`. Same nil handler. Different input:</p> <p>``` goshs -b &#39;admin:&#39; -sftp ```</p> <p>- `Username = &#34;admin&#34;`, `Password = &#34;&#34;` - `Username != &#34;&#34; &amp;&amp; Password != &#34;&#34;` → false. Password is empty. - `PasswordHandler` not set. No `-fk…</p> <p><strong>Affected:</strong> Go: github.com/patrickhener/goshs/v2, Go: goshs.de/goshs/v2</p> <p>## Summary</p> <p>Start goshs v2.1.3 with `-b &#39;admin:&#39; -sftp`. No `-fkf`. SFTP accepts connections without password. CVE-2026-40884 blocks the empty-username variant (`-b &#39;:pass&#39;`). The empty-password variant bypasses that fix.</p> <p>## CVE-2026-40884</p> <p>**CVE-2026-40884** (GHSA-c29w-qq4m-2gcv, Apr 13 2026) reported the empty-username case: `-b &#39;:pass&#39;` with `-sftp`. `sftpserver.go:85` uses `&amp;&amp;`:</p> <p>```go if s.Username != &#34;&#34; &amp;&amp; s.Password != &#34;&#34; { sshServer.PasswordHandler = func(ctx ssh.Context, password string) bool { return subtle.ConstantTimeCompare([]byte(ctx.User()), []byte(s.Username)) == 1 &amp;&amp; subtle.ConstantTimeCompare([]byte(password), []byte(s.Password)) == 1 } } ```</p> <p>Empty username → `Username != &#34;&#34;` false → `PasswordHandler` nil. No `-fkf` means `PublicKeyHandler` also nil. gliderlabs/ssh sees all handlers nil and sets `NoClientAuth = true`. Unauthenticated access.</p> <p>Patrickhener fixed it with a sanity check at `sanity/checks.go:114-118`:</p> <p>```go if opts.FTP &amp;&amp; opts.FTPSFTPMode &amp;&amp; strings.HasPrefix(opts.BasicAuth, &#34;:&#34;) { logger.Fatal(&#34;When using SFTP with password authentication, the username cannot be empty. ...&#34;) } ```</p> <p>`HasPrefix(&#34;:&#34;)` catches empty username. It does not catch empty password.</p> <p>## Empty Password Bypass</p> <p>Same `&amp;&amp;` at `sftpserver.go:85`. Same nil handler. Different input:</p> <p>``` goshs -b &#39;admin:&#39; -sftp ```</p> <p>- `Username = &#34;admin&#34;`, `Password = &#34;&#34;` - `Username != &#34;&#34; &amp;&amp; Password != &#34;&#34;` → false. Password is empty. - `PasswordHandler` not set. No `-fk…</p> https://cve.radiocsirt.org/vuln/ghsa-rjrw-mjq6-hpmm