goshs is a lightweight file server used by red teamers and developers. In versions 2.1.3 up to but not including 2.1.4, the SFTP authentication logic incorrectly checks that both the username and password are non‑empty, using Username != "" && Password != "". When the server is launched with the flags -b 'admin:' and -sftp without specifying a known‑answer password file (-fkf), this check allows a client that supplies an empty password to authenticate successfully as the user admin. The result is unauthenticated file access through the SFTP protocol, enabling an attacker to read, write or delete any files the server exposes. This bypass is a classic authentication flaw (CWE‑306).

The vulnerability affects the goshs file server distributed by goshs‑labs under the product name goshs. All installations that use the 2.1.3 series before the 2.1.4 release are vulnerable. The fix was integrated into release v2.1.4 and later.

The score of 9.1 on the CVSS base metric classifies this flaw as Critical. The estimated EPSS of less than 1 % indicates that exploitation is unlikely in the near term, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that an attacker can exploit the flaw by launching goshs with the specific command‑line arguments that trigger the bypass, or by remotely connecting to an SFTP service that has been configured with these parameters. The vulnerability provides local or remote unauthenticated access depending on how the server is exposed, so any network connected to the SFTP endpoint is at risk if the service remains enabled.