goshs, a simple HTTP server written in Go, contains an authorization bypass that allows an attacker to use a Share Token to access the full server functionalities, including executing code. The flaw, identified as CWE-288, means that an unauthorized user can retrieve any file or launch commands on the host, compromising confidentiality, integrity, and availability.

The vulnerability affects all installations of goshs from version 1.1.0 up to but not including version 2.0.0‑beta.2. The product is identified under patrickhener:goshs, and the patch was released in the 2.0.0‑beta.2 release.

The CVSS score of 8.1 classifies it as high severity; the EPSS score is undisclosed and it is not in the KEV list, but the vulnerability can be triggered by a simple HTTP request providing a Share Token, so remote attackers can execute arbitrary code or exfiltrate data. The lack of public exploitation data does not reduce the threat, as the access vector is likely remote via the web interface.