CVE-2026-34581 - Vulnerability Analysis

Overview

goshs 1.1.0 to < 2.0.0-beta.2 contains an authentication bypass caused by Share Token misuse, letting attackers execute arbitrary code and access all functionalities, exploit requires use of Share Token.

Severity & Score

Impact

Attackers can bypass file download restrictions and execute arbitrary code, leading to full system compromise.

Mitigation

Upgrade to version 2.0.0-beta.2 or later.

References

• https://github.com/patrickhener/goshs/commit/6fb224ed15c2ccc0c61a5ebe22f2401eb06e9216
• https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.2
• https://github.com/patrickhener/goshs/security/advisories/GHSA-jgfx-74g2-9r6g

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner