Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-29 | 4 | Disclosure4 |
| 2026-07-30 | 1 | Disclosure1 |
| 2026-08-15 | 1 | General1 |
6月に CVE を2件取得したんだけど、先月末に1件公開されたみたい (CVE-2026-62325) 申請の数が最近ものすごく増えてるみたいで、脆弱性コーディネーターもなかなか大変そう😥 https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm
Post summary
The post notes discovery of two CVEs, references CVE‑2026‑62325, and links to a GitHub advisory, but provides no PoC, exploit code, active use evidence, patch info, or technical details.
CVE-2026-62325 is a critical vulnerability in the goshs single-binary file server that allows unauthenticated remote code execution.
Post summary
The statement announces CVE-2026-62325 as a critical vulnerability in the goshs single‑binary file server that permits unauthenticated remote code execution.
CVE-2026-62325 goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username … https://www.cve.org/CVERecord?id=CVE-2026-62325
Post summary
The text announces a vulnerability in goshs’s SFTP password handler for versions 2.1.3 to 2.1.4, but offers no further details, PoC, or mitigation information.
CVE-2026-62325: Authentication Bypass in goshs SFTP Server via Missing Password Check. https://ift.tt/ibBJFPY
Post summary
The tweet announces a newly disclosed authentication bypass in the goshos SFTP server, highlighting that the flaw stems from a missing password check, and provides a link for additional details.
CVE-2026-62325: Authentication Bypass in goshs SFTP Server via Missing Password Check. https://ift.tt/ibBJFPY
Post summary
The text announces a newly identified authentication bypass vulnerability (CVE‑2026‑62325) affecting the goshs SFTP server, outlining the missing password check flaw.
🚨*CVE* CVE-2026-62325 goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username … https://www.cve.org/CVERecord?id=CVE-2026-62325 ----- Traducción: CVE-2026-62325 gos… http://infoflow.cloud`
Post summary
The message announces CVE-2026-62325 in goshs, noting a flaw in the sftpserver password handler, but does not provide PoC, exploit code, exploitation evidence, or patch information.