PoC Index

CVE-2025-46816

CRITICAL 9.4EPSS 0.7%

goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function `dispatchReadPump` does not checks the option cli `-c`, thus allowing anyone to execute arbitrary command through the use of websockets. Version 1.0.5 fixes the issue.

CVSS v3.0
9.4 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v3.0
9.4 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
EPSS
0.69% chance of exploitation in the next 30 days, 50th percentile
Published
2025-05-06

Proof-of-concept exploits (2)

References

Related