Executive brief
goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request in goshs.de/goshs
Affected products
- Go goshs.de/goshs/v2
- Go goshs.de/goshs
Junglewise Threat Intelligence
GO-2026-5519 - goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request in goshs.de/goshs
Severity: info · Published 2026-06-25
Technologies: goshs.de/goshs/v2 (Go), goshs.de/goshs (Go). Vendors: Go.
Related threats
- goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, rel
- goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction
- goshs-labs goshs ACL bypass via trailing slash in sendFile handler
- goshs path traversal in multipart upload handler
- goshs WebDAV deletion bypass via MOVE and COPY methods