Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.0-beta.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-04-03 | 3 | Disclosure3 |
| 2026-05-02 | 1 | Patch1 |
goshs share tokens are useless. CVE-2026-34581 lets attackers RCE your server with a token. Upgrade to 2.0.0-beta.2 immediately. #CVE #RCE #GoLang #git #gitlab #github info: https://www.valtersit.com/cve/2026/04/cve-2026-34581/
Post summary
CVE-2026-34581 enables RCE via a token, and the primary recommendation is to upgrade to version 2.0.0-beta.2 to mitigate the issue.
CVE-2026-34581 goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected… https://www.cve.org/CVERecord?id=CVE-2026-34581
Post summary
The post briefly discloses that CVE-2026-34581 allows Share Token bypass in the goshs SimpleHTTPServer across versions 1.1.0 to pre‑2.0.0‑beta.2.
🚨*CVE* CVE-2026-34581 goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected… https://www.cve.org/CVERecord?id=CVE-2026-34581 ----- Traducción: CVE-2026-34581 gos… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-34581, noting a token‑bypass vulnerability in goshs SimpleHTTPServer versions 1.1.0 to before 2.0.0‑beta2, with no evidence of exploitation or patch details.
🟠 CVE-2026-34581 - High goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all t... https://www.thehackerwire.com/vulnerability/CVE-2026-34581/ https://t.co/N1yV8lsdW8
Post summary
The article discloses a high‑severity flaw in goshs that allows bypassing download restrictions via the Share Token, but it provides no exploit code, active‑exploitation evidence, or patch information.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | goshs | goshs | - | go | - |
| App | goshs | goshs | 2.0.0 | go | - |