{"vulnerability": "cve-2026-62325", "sightings": [{"uuid": "52cd7fc3-f314-4e5f-9b52-1d882a735fd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-62325", "type": "published-proof-of-concept", "source": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm", "content": "", "creation_timestamp": "2026-07-28T22:35:41.992643Z"}, {"uuid": "d9662568-8bb6-4f61-b8a3-5c00b49a15e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62325", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrqm5cwt5q2y", "content": "CVE-2026-62325 - patrickhener\nAn outdated version of goshs allows SFTP connections without a password. This is a security risk because it means anyone can access your SFTP server without needing a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#patrickhener #Golang #CVE #infosec", "creation_timestamp": "2026-07-28T23:52:04.557462Z"}, {"uuid": "bde59b7a-5e95-4903-87ff-e3f87c4684ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62325", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqmmod6fj2d", "content": "\ud83d\udd34 CVE-2026-62325 - Critical (9.1)\n\ngoshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 unti...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-62325/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-29T00:00:40.162550Z"}, {"uuid": "0576ae25-95a3-42d3-8fa1-7175a345aa44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62325", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mrqrva7dds2b", "content": "Critical File Server Flaw, Another Masterclass in Internet Self-Harm\nPANIC 84% | Lag 0.0h | CVE-2026-62325 is a critical vulnerability in goshs, a single-binary file server used by red teamers\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-07-29T01:35:01.962577Z"}, {"uuid": "4536239b-16c6-4527-b098-61bceb899f41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62325", "type": "seen", "source": "https://gist.github.com/alon710/b7d97e28e81c8217964934097e896a47", "content": "# CVE-2026-62325: CVE-2026-62325: Authentication Bypass in goshs SFTP Server via Missing Password Check\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-62325\n\n## Summary\nA critical authentication bypass vulnerability in the SFTP server module of goshs version 2.1.3 allows remote, unauthenticated attackers to read, write, modify, or delete files on the target hosting environment. This vulnerability is caused by an incomplete logic check during initialization that falls back to a password-less configuration when an empty password string is specified.\n\n## TL;DR\nConfiguring the goshs file server with an empty password causes the SFTP engine to bypass password handler registration. This defaults the underlying gliderlabs/ssh library to NoClientAuth=true, allowing unauthenticated network clients to gain full SFTP access.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.1 (Critical)\n- **Exploit Status**: Proof of Concept (PoC) Available\n- **KEV Status**: Not Listed\n- **Impact**: High (Confidentiality and Integrity)\n\n## Affected Systems\n\n- goshs\n- github.com/patrickhener/goshs/v2\n- goshs.de/goshs/v2\n- **goshs**: >= 2.1.3, < 2.1.4 (Fixed in: `2.1.4`)\n\n## Mitigation\n\n- Upgrade goshs binary to v2.1.4 or higher\n- Ensure basic authentication passwords are non-empty when using SFTP\n- Configure key-based authentication with -fkf to enforce key verification\n- Restrict network access to SFTP port 2121 using localized firewall structures\n\n**Remediation Steps:**\n1. Audit all active processes to detect running instances of goshs.\n2. Check command-line flags for configurations utilizing basic authentication with empty passwords (e.g., matching the regex pattern `-b ['\"]?[a-zA-Z0-9_-]+:['\"]?`).\n3. Kill the active process and download the latest version v2.1.4 release.\n4. Restart the service with strong, non-empty basic authentication credentials.\n\n## References\n\n- [GitHub Security Advisory GHSA-rjrw-mjq6-hpmm](https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm)\n- [Authentication Fix Commit](https://github.com/goshs-labs/goshs/commit/32f4a0e1790a709f722d0f3b2341f139d003180a)\n- [goshs v2.1.4 Release](https://github.com/goshs-labs/goshs/releases/tag/v2.1.4)\n- [goshs Project Repository](https://github.com/goshs-labs/goshs)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-62325) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T08:31:18.120726Z"}]}