CVE-2026-62325: goshs SFTP Auth Bypass Vulnerability

CVE-2026-62325 Overview

CVE-2026-62325 is an authentication bypass vulnerability in goshs, a single-binary file server used by red teamers and developers. The flaw exists in the sftpserver/sftpserver.go password handler, which used a logical AND condition (Username != "" && Password != "") to determine whether authentication should be enforced. Running goshs with a command such as -b 'admin:' -sftp and no -fkf flag left both SFTP authentication handlers unset. Remote, unauthenticated attackers can then access files served over SFTP. The issue affects versions 2.1.3 through 2.1.4 and is tracked as [CWE-306: Missing Authentication for Critical Function].

Critical Impact

Unauthenticated remote attackers can read and write files exposed through the SFTP service when goshs is started with an empty password argument.

Affected Products

• goshs versions 2.1.3 up to (but not including) 2.1.4
• goshs SFTP server component (sftpserver/sftpserver.go)
• Deployments started with -b '<user>:' -sftp and no -fkf flag

Discovery Timeline

• 2026-07-28 - CVE-2026-62325 published to NVD
• 2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-62325

Vulnerability Analysis

The vulnerability originates in the SFTP server initialization logic. The password handler was only registered when both s.Username and s.Password were non-empty strings. When an operator supplied credentials in the form admin: (username set, password empty), the AND condition evaluated to false and no PasswordHandler was attached to the SSH server. Without a host key file (-fkf) and without an active password handler, both authentication paths remained unset. The SFTP subsystem then accepted incoming sessions without validating any credentials, exposing every file within the served directory to remote read and write operations.

Root Cause

The root cause is an incorrect boolean operator in the credential-gating check. The original code used && where || was required, causing the handler to be skipped whenever either field was blank. This is a classic missing authentication for critical function defect ([CWE-306]).

Attack Vector

Exploitation requires network reachability to the SFTP port exposed by goshs. No credentials, user interaction, or privileges are needed. An attacker connects with any standard SFTP client and receives full session access to the served file tree.

// Patch diff from sftpserver/sftpserver.go
		sshServer.HostSigners = []ssh.Signer{private}
	}

-	if s.Username != "" && s.Password != "" {
+	if s.Username != "" || s.Password != "" {
		sshServer.PasswordHandler = func(ctx ssh.Context, password string) bool {
			return subtle.ConstantTimeCompare([]byte(ctx.User()), []byte(s.Username)) == 1 && subtle.ConstantTimeCompare([]byte(password), []byte(s.Password)) == 1
		}
// Source: https://github.com/goshs-labs/goshs/commit/32f4a0e1790a709f722d0f3b2341f139d003180a

The fix replaces && with ||, ensuring that the password handler is registered whenever either the username or password is set. See the GitHub Security Advisory GHSA-rjrw-mjq6-hpmm for further detail.

Detection Methods for CVE-2026-62325

Indicators of Compromise

• Successful SFTP session establishment to a goshs instance without a preceding password authentication event in server logs.
• goshs process command lines containing -sftp with a trailing colon username argument such as -b 'admin:' and no -fkf flag.
• Outbound SFTP transfers originating from hosts running goshs versions 2.1.3 through 2.1.4.

Detection Strategies

• Inventory running goshs binaries and compare against version 2.1.4 using package metadata or goshs -v output.
• Inspect process arguments across the environment for -b values with empty password components paired with -sftp.
• Correlate SSH/SFTP connection logs on goshs hosts with authentication events to identify sessions that skipped credential validation.

Monitoring Recommendations

• Alert on new listening sockets bound by the goshs binary, particularly on non-standard SSH ports.
• Monitor for unexpected file read or write bursts on directories exposed by red-team or developer tooling.
• Track egress SFTP traffic from developer and operator workstations for anomalous destinations.

How to Mitigate CVE-2026-62325

Immediate Actions Required

• Upgrade all goshs installations to version 2.1.4 or later.
• Terminate any running goshs process invoked with -sftp and an empty password argument until the upgrade is applied.
• Audit file directories previously exposed through vulnerable goshs instances for unauthorized access or modification.

Patch Information

The fix is delivered in goshs release v2.1.4 and corresponds to commit 32f4a0e. Full details are published in GHSA-rjrw-mjq6-hpmm.

Workarounds

• Always supply a non-empty password when starting goshs with SFTP, for example -b 'admin:StrongPassword'.
• Provide a forced key file with -fkf so SFTP authentication relies on key-based validation rather than password handling.
• Bind goshs to loopback or restrict access with host firewall rules until the patched build is deployed.

# Patched invocation with explicit credentials
goshs -b 'admin:StrongPassword' -sftp -fkf /path/to/authorized_keys

# Verify goshs version
goshs -v   # expect 2.1.4 or later