These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-66064 is a vulnerability in goshs, a single-binary file server, where an attacker could bypass authorization checks using a trailing slash in the URL path. The issue is fixed in version 2.1.5. This vulnerability allows an attacker to potentially access sensitive files and bypass authorization checks. Defenders should assess exposure and verify the version of goshs is 2.1.5 or later. The CVE recor [truncated]
CVE-2026-66063 is a vulnerability in goshs, a single-binary file server, that allows unauthenticated uploads with filenames containing .. to create files outside the served tree. This issue was fixed in version 2.1.5. The vulnerability exists in the httpserver/updown.go multipart upload handler, which splits part.FileName() on / but does not reject .., allowing an unauthenticated upload with filename .. t [truncated]
CVE-2026-64863 is a critical vulnerability in goshs, a single-binary file server, allowing unauthorized file deletion or overwrite via WebDAV MOVE requests. The issue, fixed in version 2.1.4, has a CVSS score of 9.1 and is considered critical. This vulnerability affects goshs installations where unauthorized file modifications could have significant impacts. Defenders and administrators should prioritize [truncated]
CVE-2026-62325 is a critical vulnerability in goshs, a single-binary file server, that allows unauthenticated file access due to a flawed SFTP authentication handler. The issue was introduced in version 2.1.3 and fixed in version 2.1.4. Defenders should assess and remediate this vulnerability to prevent potential unauthorized file access. The vulnerability has a CVSS score of 9.1 and is considered critica [truncated]
CVE-2026-54719 is a vulnerability in goshs, a single-binary file server, that allows unauthenticated reads of files protected by .goshs folder ACLs and block lists prior to version 2.1.1. The issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189. Affected deployments should verify exposure, especially those with publicly accessible bulk download features, a [truncated]
