Is github.com/patrickhener/goshs/v2 safe ? github.com/patrickhener/goshs/v2 (go) has 11 known vulnerabilities, the worst rated CRITICAL. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
// reach 0 direct dependencies
none carry a known advisory
0 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 37th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-rjrw-mjq6-hpmm, the advisory selected below
// 11 advisories GHSA-rjrw-mjq6-hpmm Start goshs v2.1.3 with -b 'admin:' -sftp. CRIT GHSA-hq33-8jgp-8qq3 The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce --no-delete on the WebDAV MOVE verb. CRIT GHSA-c29w-qq4m-2gcv goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. CRIT GHSA-rmxw-pq4x-3fvh GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes (PUT/POST upload/?mkdir/?delete) and added recursive ACL resolution… HIGH GHSA-5h6h-7rc9-3824 goshs contains an SFTP root escape caused by prefix-based path validation. HIGH GHSA-7h3j-592v-jcrp goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. HIGH GHSA-964w-f6gj-5236 sendFile derives the served filename from the raw request path while opening the file from the cleaned path, so appending a trailing slash empties the derived… MODE GHSA-wg2q-39h6-66x9 The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree. MODE GHSA-rhf7-wvw3-vjvm The PUT upload handler (httpserver/updown.go) lacks the CSRF token validation that was added to the POST upload handler during the GHSA-jrq5-hg6x-j6g3 fix. MODE GHSA-jrq5-hg6x-j6g3 goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. MODE GHSA-7qx6-f23w-3w7f The GET /?redirect endpoint in goshs v2.0.0-beta.6 performs an HTTP redirect to any attacker-supplied url= value and writes any attacker-supplied header=Name… LOW // cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability None // questions Is github.com/patrickhener/goshs/v2 safe to install? CyberXYZ does not call a package safe in absolute terms. It records 11 known vulnerabilities for github.com/patrickhener/goshs/v2 (go), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does github.com/patrickhener/goshs/v2 have known vulnerabilities? Yes. CyberXYZ records 11 known vulnerabilities for github.com/patrickhener/goshs/v2 (go), the worst rated CRITICAL. These include GHSA-rjrw-mjq6-hpmm, GHSA-hq33-8jgp-8qq3, GHSA-c29w-qq4m-2gcv, GHSA-rmxw-pq4x-3fvh, GHSA-5h6h-7rc9-3824.
How do I check github.com/patrickhener/goshs/v2 before installing? Search github.com/patrickhener/goshs/v2 in CyberXYZ Check at https://cyberxyz.io/check?q=github.com%2Fpatrickhener%2Fgoshs%2Fv2 . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 06:17 UTC. The most recent advisory here was published 2026-07-28. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page