httpserver

Mar 13, 2026 GO-2026-4953 +15 more

  GO-2026-4953: goshs is Missing Write Protection for Parametric Data Values in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5469: goshs has Auth Bypass via Share Token in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Changes in this version

type FileServer

+ Invisible bool

+ Tunnel bool

+ func (fs *FileServer) InvisibleBasicAuthMiddleware(next http.Handler) http.Handler

Nov 12, 2025 GO-2026-4953 +15 more

  GO-2026-4953: goshs is Missing Write Protection for Parametric Data Values in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5469: goshs has Auth Bypass via Share Token in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Sep 22, 2025 GO-2026-4953 +15 more

  GO-2026-4953: goshs is Missing Write Protection for Parametric Data Values in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5469: goshs has Auth Bypass via Share Token in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Changes in this version

type FileServer

+ UploadFolder string

Jun 3, 2025 GO-2026-4953 +15 more

  GO-2026-4953: goshs is Missing Write Protection for Parametric Data Values in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5469: goshs has Auth Bypass via Share Token in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Changes in this version

+ func GenerateQRCode(uri string) string

+ func GenerateToken() string

+ type DownloadEntry struct

+ DownloadURL string

+ QRCode template.URL

type FileServer

+ SharedLinks map[string]SharedLink

+ func (fs *FileServer) CreateShareHandler(w http.ResponseWriter, r *http.Request)

+ func (fs *FileServer) DeleteShareHandler(w http.ResponseWriter, r *http.Request)

+ func (fs *FileServer) ShareHandler(w http.ResponseWriter, r *http.Request)

+ type SharedLink struct

+ DownloadEntries []DownloadEntry

+ DownloadLimit int

+ Expires time.Time

+ FilePath string

+ IsDir bool

May 28, 2025 GO-2026-4953 +14 more

  GO-2026-4953: goshs is Missing Write Protection for Parametric Data Values in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Changes in this version

+ func GetClientIP(r *http.Request, whitelist *Whitelist) string

type FileServer

+ Whitelist *Whitelist

+ func (fs *FileServer) IPWhitelistMiddleware(next http.Handler) http.Handler

+ type Whitelist struct

+ Enabled bool

+ Networks []*net.IPNet

+ TrustedProxies []*net.IPNet

+ func NewIPWhitelist(cidrs string, enabled bool, trustedProxies string) (*Whitelist, error)

+ func (w *Whitelist) IsAllowed(ipStr string) bool

+ func (w *Whitelist) IsTrustedProxy(ipStr string) bool

May 20, 2025 GO-2026-4953 +14 more

  GO-2026-4953: goshs is Missing Write Protection for Parametric Data Values in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

May 19, 2025 GO-2026-4953 +14 more

  GO-2026-4953: goshs is Missing Write Protection for Parametric Data Values in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Changes in this version

type FileServer

+ P12NoPass bool

May 12, 2025 GO-2026-5146 +13 more

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

May 6, 2025 GO-2026-5146 +13 more

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

May 2, 2025 GO-2025-3672 +14 more

  GO-2025-3672: goshs route not protected, allows command execution in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Changes in this version

+ type CustomMux struct

+ func NewCustomMux() *CustomMux

+ func (cm *CustomMux) Handle(pattern string, handler http.Handler)

+ func (cm *CustomMux) HandleFunc(pattern string, handler http.HandlerFunc)

+ func (cm *CustomMux) ServeHTTP(w http.ResponseWriter, r *http.Request)

+ func (cm *CustomMux) Use(mw Middleware)

type FileServer

+ NoDelete bool

+ Webhook webhook.Webhook

+ WebhookEnable bool

+ WebhookEvents []string

+ WebhookProvider string

+ WebhookURL string

+ func (fs *FileServer) HandleWebhookSend(message string, event string)

+ type Middleware func(http.Handler) http.Handler

Apr 16, 2025 GO-2025-3672 +14 more

  GO-2025-3672: goshs route not protected, allows command execution in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Changes in this version

type FileServer

+ func (fs *FileServer) ServerHeaderMiddleware(next http.Handler) http.Handler

Mar 7, 2025 GO-2025-3672 +14 more

  GO-2025-3672: goshs route not protected, allows command execution in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Changes in this version

type FileServer

+ NoClipboard bool

Nov 22, 2024 GO-2025-3672 +14 more

  GO-2025-3672: goshs route not protected, allows command execution in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Nov 15, 2024 GO-2025-3672 +14 more

  GO-2025-3672: goshs route not protected, allows command execution in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Oct 17, 2024 GO-2025-3672 +14 more

  GO-2025-3672: goshs route not protected, allows command execution in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Changes in this version

type FileServer

+ func (fs *FileServer) PrintInfoUseBasicAuth(mux *mux.Router, what string)

+ func (fs *FileServer) SetupMux(mux *mux.Router, what string) string

+ func (fs *FileServer) StartListener(server http.Server, what string, listener net.Listener)

Jul 11, 2024 GO-2025-3672 +14 more

  GO-2025-3672: goshs route not protected, allows command execution in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Changes in this version

type FileServer

+ CACert string

+ func (files *FileServer) AddCertAuth(server *http.Server)

Jul 5, 2024 GO-2025-3672 +14 more

  GO-2025-3672: goshs route not protected, allows command execution in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Changes in this version

type FileServer

+ MyP12 string

Jun 27, 2024 GO-2025-3672 +14 more

  GO-2025-3672: goshs route not protected, allows command execution in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Changes in this version

type FileServer

+ Embedded bool

+ func (files *FileServer) PrintEmbeddedFiles()

Apr 30, 2024 GO-2025-3672 +14 more

  GO-2025-3672: goshs route not protected, allows command execution in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Changes in this version

type FileServer

+ LetsEncrypt bool

Apr 10, 2024 GO-2025-3672 +14 more

  GO-2025-3672: goshs route not protected, allows command execution in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Sep 1, 2023 GO-2025-3672 +14 more

  GO-2025-3672: goshs route not protected, allows command execution in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Jun 21, 2023 GO-2025-3672 +14 more

  GO-2025-3672: goshs route not protected, allows command execution in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Jun 1, 2023 GO-2025-3672 +14 more

  GO-2025-3672: goshs route not protected, allows command execution in github.com/patrickhener/goshs

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Changes in this version

type FileServer

+ CLI bool

May 31, 2023 GO-2026-5146 +13 more

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

May 26, 2023 GO-2026-5146 +13 more

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Changes in this version

type FileServer

+ DropUser string

May 8, 2023 GO-2026-5146 +13 more

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Feb 28, 2023 GO-2026-5146 +13 more

  GO-2026-5146: SFTP root escape via prefix-based path validation in goshs in github.com/patrickhener/goshs

  GO-2026-5186: goshs: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in github.com/patrickhener/goshs

  GO-2026-5221: goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access in github.com/patrickhener/goshs

  GO-2026-5232: Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs

  GO-2026-5303: goshs has an empty-username SFTP password authentication bypass in github.com/patrickhener/goshs

  GO-2026-5394: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload in github.com/patrickhener/goshs

  GO-2026-5468: goshs: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload in github.com/patrickhener/goshs

  GO-2026-5479: goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation in github.com/patrickhener/goshs

  GO-2026-5625: goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS in github.com/patrickhener/goshs

  GO-2026-5728: goshs has a file-based ACL authorization bypass in goshs state-changing routes in github.com/patrickhener/goshs

  GO-2026-6133: goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

  GO-2026-6134: goshs has ACL Bypass & Path Traversal in github.com/patrickhener/goshs

  GO-2026-6136: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

  GO-2026-6137: goshs has a Path Traversal issue in github.com/patrickhener/goshs

Changes in this version

+ type FileServer struct

+ Clipboard *clipboard.Clipboard

+ Fingerprint1 string

+ Fingerprint256 string

+ Hub *ws.Hub

+ IP string

+ MyCert string

+ MyKey string

+ Pass string

+ Port int

+ ReadOnly bool

+ SSL bool

+ SelfSigned bool

+ Silent bool

+ UploadOnly bool

+ User string

+ Verbose bool

+ Version string

+ WebdavPort int

+ Webroot string

+ func (fs *FileServer) BasicAuthMiddleware(next http.Handler) http.Handler

+ func (fs *FileServer) Start(what string)