CVE-2026-62325

Name of the Vulnerable Software and Affected Versions goshs versions 2.1.3 through 2.1.3

Description An authentication bypass exists in the SFTP server component when the application is started with a basic authentication string containing a username but an empty password (e.g., -b 'admin:'), the -sftp flag enabled, and the -fkf flag disabled. The issue stems from the use of a logical AND (&&) operator in the sftpserver/sftpserver.go password handler. If either the username or password is empty, the PasswordHandler is not initialized. When both the PasswordHandler and PublicKeyHandler are unset, the underlying SSH library sets NoClientAuth to true, allowing unauthenticated users to access files, including reading, writing, deleting, and renaming them.

Recommendations Update goshs to version 2.1.4. As a temporary workaround, avoid starting the server with an empty password in the basic authentication string when using SFTP without public key files.