Executive brief
goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request
Affected products
- Go goshs.de/goshs/v2
Junglewise Threat Intelligence
goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request
Severity: low · CVSS 3.1 · Published 2026-05-15
Technologies: goshs.de/goshs/v2 (Go). Vendors: Go.
Related threats
- goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, rel
- goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction
- goshs-labs goshs ACL bypass via trailing slash in sendFile handler
- goshs path traversal in multipart upload handler
- goshs WebDAV deletion bypass via MOVE and COPY methods