goshs SFTP Auth Bypass Persists: Empty-Password Variant Evades CVE-2026-40884 Fix

A newly published GitHub Security Advisory (GHSA-rjrw-mjq6-hpmm, CVSS 9.1, tracked as CVE-2026-62325) reports that goshs v2.1.3 remains vulnerable to unauthenticated SFTP access despite an earlier fix for CVE-2026-40884. According to the advisory, the original fix only blocked the empty-username case (-b ':pass') via a strings.HasPrefix(":") sanity check, but the underlying root cause — a faulty && conditional in sftpserver.go that only installs a password handler when both username and password are non-empty — was never corrected. As reported, this leaves an empty-password variant (-b 'admin:' -sftp, without -fkf) exploitable: with no password or public-key handler registered, the underlying gliderlabs/ssh library sets NoClientAuth = true, permitting unauthenticated SFTP connections.

Why It Matters

goshs is a Go-based HTTP/SFTP file server commonly used for quick file sharing and, per public usage patterns, in red-team and pentest file-exfiltration workflows. Any deployment run with SFTP mode enabled and a basic-auth string ending in a colon (empty password) is exposed to unauthenticated read, write, delete, and rename access over SFTP — the same practical impact as the originally patched CVE-2026-40884, reachable through an unblocked input path. A public PoC is already available, and the advisory notes this affects all current goshs versions, including the version that shipped the prior fix.

What Defenders Should Do Now

• Identify any hosts running goshs with -sftp enabled, particularly those started with a basic-auth string of the form user: (trailing colon, empty password) and without -fkf.
• Treat goshs SFTP listeners as high-risk until an upstream fix lands; consider disabling SFTP mode or restricting network access to trusted hosts in the interim.
• Hunt for SSH/SFTP session establishment on goshs's listening port with no client authentication method negotiated, or successful logins with empty/blank password fields in session logs.
• Monitor for unexpected file read/write/delete/rename activity on hosts exposing goshs SFTP shares, especially from unrecognized source IPs.
• Track upstream for a patch addressing the root-cause && logic in sftpserver.go (recommended fix per the advisory: change to ||, plus a corresponding HasSuffix(":") sanity check).

This is developing intel based on a same-day GitHub Security Advisory; details may be updated as the maintainer responds and a complete patch is released. See the original advisory for full technical detail and proof-of-concept: GHSA-rjrw-mjq6-hpmm.