goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

Summary Start goshs v2.1.3 with -b 'admin:' -sftp. No -fkf. SFTP accepts connections without password. CVE-2026-40884 blocks the empty-username variant -b ':pass'. The empty-password variant bypasses that fix. CVE-2026-40884 CVE-2026-40884 GHSA-c29w-qq4m-2gcv, Apr 13 2026 reported the...

EUVD-2026-50079

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allow...

CVE-2026-40884

creationtimestamp| type| source ---|---|--- 2026-04-13 07:56:55+00:00| published-proof-of-concept| https://github.com/patrickhener/goshs/security/advisories/GHSA-c29w-qq4m-2gcv 2026-04-17 02:29:24+00:00| seen| https://bsky.app/profile/pmloik.bsky.social/post/3mjnuvsllad2g 2026-04-20 23:27:34+00:0...