CVE-2026-42091

In goshs file server before version 2.1.4, the WebDAV MOVE method handling did not enforce the --no-delete option, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T.

In goshs from version 2.1.3 to 2.1.4, the SFTP password handler only checked that username and password are not empty, so running with -b 'admin:' -sftp and without -fkf left both SFTP authentication handlers unset, allowing unauthenticated file access.

goshs is a SimpleHTTPServer written in Go, which prior to version 2.0.0-beta.6 had an ArtiPACKED vulnerability. This vulnerability can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code.

In goshs prior to 2.0.0-beta.3, the tdeleteFile() function lacks a return after path traversal check, potentially allowing attackers to access files outside the intended directory.

In goshs prior to 2.0.0-beta.3, the POST multipart upload directory is not sanitized, potentially allowing attackers to write files to arbitrary locations.

In goshs prior to 2.0.0-beta.3, the PUT upload in httpserver/updown.go has no path sanitization, potentially allowing attackers to write files outside the intended directory.

In goshs, a SimpleHTTPServer written in Go, before version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same snapshot and pass the check, exceeding the intended cap. Version 2.1.0 patches the issue.

goshs, a simple HTTP server written in Go, does not enforce mode-restriction flags (--read-only, --upload-only, --no-delete) on the WebDAV port when WebDAV is enabled (-w). An authenticated WebDAV client can perform PUT, DELETE, MKCOL, MOVE, and COPY operations despite the operator's intent. The issue is fixed in version 2.1.0.

In the goshs file server before version 2.1.5, the sendFile handler in httpserver/handler.go opened files using a cleaned path but derived the authorization filename from raw req.URL.Path. A trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.

In the goshs file server before version 2.1.5, the multipart upload handler in httpserver/updown.go split part.FileName() on / but did not reject .., allowing an unauthenticated attacker to upload a file with a filename containing .. and create a file outside the served tree. This issue is fixed in version 2.1.5.