CVE-2026-34581: goshs Authentication Bypass Vulnerability

CVE-2026-34581 Overview

CVE-2026-34581 is an authentication bypass vulnerability in goshs, a SimpleHTTPServer written in Go. The flaw exists in versions 1.1.0 through versions prior to 2.0.0-beta.2, where the Share Token feature can be exploited to bypass restricted file download limitations and gain access to all goshs functionalities, including remote code execution capabilities.

Critical Impact
Attackers can bypass Share Token access controls to achieve full server functionality access, including arbitrary code execution on the target system.

Affected Products

goshs versions 1.1.0 to < 2.0.0-beta.2

Discovery Timeline

2026-04-02 - CVE CVE-2026-34581 published to NVD
2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34581

Vulnerability Analysis

This vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The Share Token feature in goshs was designed to provide restricted access for limited file downloads. However, the implementation failed to properly enforce access controls across all server endpoints, allowing token-authenticated users to access privileged functionalities that should have been restricted.

The flaw enables attackers with a valid Share Token to bypass the intended access restrictions and invoke sensitive server operations. Most critically, this includes access to code execution capabilities that were meant to be protected from token-based access. The network-based attack vector requires user interaction, but once exploited, can lead to high confidentiality and integrity impacts on the affected system.

Root Cause

The root cause stems from insufficient authorization checks in the HTTP request handler. When processing requests with Share Token authentication, the server did not validate whether the requested endpoint should be accessible to token-authenticated users. Multiple sensitive endpoints including SMTP attachment handling (smtp), system information disclosure (goshs-info), directory creation (mkdir), and WebSocket connections (ws) lacked proper token access validation, allowing authenticated token users to access these privileged functions.

Attack Vector

The attack is network-based and exploits the authorization bypass in the Share Token mechanism. An attacker with a valid Share Token can craft HTTP requests to sensitive endpoints by appending the token parameter while accessing protected server functionalities. Since the early parameter handling in the request router did not verify token-based restrictions before routing to sensitive handlers, all goshs features become accessible regardless of the intended Share Token limitations.

// Vulnerable code pattern - missing token access validation
func (fs *FileServer) earlyBreakParameters(w http.ResponseWriter, req *http.Request) bool {
	if _, ok := req.URL.Query()["smtp"]; ok {
		// Missing: denyForTokenAccess check
		fs.handleSMTPAttachment(w, req)
		return true
	}
	if _, ok := req.URL.Query()["goshs-info"]; ok {
		// Missing: denyForTokenAccess check
		fs.handleInfo(w)
		return true
	}
	if _, ok := req.URL.Query()["mkdir"]; ok {
		// Missing: denyForTokenAccess check
		fs.handleMkdir(w, req)
		return true
	}
	if _, ok := req.URL.Query()["ws"]; ok {
		// Missing: denyForTokenAccess check
		fs.socket(w, req)
		return true
	}
}

Source: GitHub Commit Update

Detection Methods for CVE-2026-34581

Indicators of Compromise

HTTP requests containing both token= parameter and sensitive query parameters (smtp, goshs-info, mkdir, ws)
Unusual access patterns to goshs administrative endpoints from Share Token authenticated sessions
WebSocket connection attempts or directory creation operations from token-authenticated users

Detection Strategies

Monitor HTTP access logs for requests combining Share Token authentication with privileged endpoint access
Implement network-based detection rules to flag requests with token= parameter accessing administrative endpoints
Review goshs logs for unauthorized operations executed during token-authenticated sessions

Monitoring Recommendations

Deploy web application firewall (WAF) rules to detect and block exploitation attempts targeting the authentication bypass
Enable detailed logging for all goshs endpoints to capture potential exploitation attempts
Set up alerts for any code execution or system modification operations triggered by token-authenticated users

How to Mitigate CVE-2026-34581

Immediate Actions Required

Upgrade goshs to version 2.0.0-beta.2 or later immediately
If immediate upgrade is not possible, disable the Share Token feature until patching is complete
Audit logs for any evidence of exploitation prior to patching
Review and restrict network access to goshs instances to trusted users only

Patch Information

The vulnerability has been patched in goshs version 2.0.0-beta.2. The fix implements a new denyForTokenAccess() function that validates whether a request is using token-based authentication and denies access to privileged endpoints accordingly. The patch ensures that all sensitive handler functions perform token access validation before processing requests.

The security fix can be reviewed in the GitHub Security Advisory GHSA-jgfx-74g2-9r6g and the patched release v2.0.0-beta.2.

Workarounds

Disable Share Token functionality entirely if upgrading is not immediately feasible
Implement network-level access controls to restrict goshs access to trusted IP addresses only
Place goshs behind a reverse proxy with additional authentication requirements
Monitor and audit all token-authenticated access until the patch can be applied

// Patched code - token access validation added
func denyForTokenAccess(w http.ResponseWriter, r *http.Request) bool {
	if r.URL.Query().Get("token") != "" {
		http.Error(w, "Forbidden", http.StatusForbidden)
		return true
	}
	return false
}