CVE-2026-50139 debrief: goshs SimpleHTTPServer vulnerability allows concurrent file downloads beyond intended limits due to improper synchronization in the ShareHandler. This issue enables multiple requests to bypass the download limit check, leading to increased resource consumption and server load. Defenders should assess exposure, verify versions, and apply patches to prevent this issue. The vulnerabil [truncated]
CVE-2026-50138 debrief: goshs SimpleHTTPServer has a WebDAV mode-restriction bypass vulnerability. When launched with WebDAV enabled, the server does not enforce mode-restriction flags on the WebDAV port, allowing authenticated clients to perform unauthorized actions such as PUT, DELETE, MKCOL, MOVE, and COPY. Operators should assess exposure and verify configuration to prevent unauthorized actions. The v [truncated]
The goshs SimpleHTTPServer written in Go has a path traversal vulnerability prior to version 2.0.0-beta.3. The tdeleteFile() function was missing a return statement after a path traversal check, allowing for potential directory traversal attacks. This issue has been fixed in version 2.0.0-beta.3. Users of goshs SimpleHTTPServer version prior to 2.0.0-beta.3 should update to the latest version to prevent p [truncated]
A critical vulnerability was discovered in goshs, a SimpleHTTPServer written in Go. The vulnerability exists in the PUT upload functionality in httpserver/updown.go, where path sanitization is not performed. This allows an attacker to potentially upload files to arbitrary locations on the server. The vulnerability was fixed in version 2.0.0-beta.3.
