CVE-2026-62325

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-62325
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-62325.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-62325
Aliases
Downstream
Related
Published
2026-07-28T21:52:05Z
Modified
2026-10-25T02:33:14Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)
Details

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62325.json"
}
References

Affected packages

Git / github.com/goshs-labs/goshs

Affected ranges

Type
GIT
Repo
https://github.com/goshs-labs/goshs
Events
Introduced
ead99b9b5081d473c61743cfed5e8290702317d2
Fixed
d4e775d5a84d662d426bc19a95d9b990a97d60e4
Fixed
32f4a0e1790a709f722d0f3b2341f139d003180a
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.1.3"
                },
                {
                    "fixed": "2.1.4"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "32f4a0e1790a709f722d0f3b2341f139d003180a"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v2.1.4",
            "range": [
                {
                    "fixed": "d4e775d5a84d662d426bc19a95d9b990a97d60e4"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v2.*
v2.1.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-62325.json"