CVE-2025-46816
criticalpriority · track · 10EPSS 0.007 · 54 %ileexploit · PoCEUUSEPSS · scored 2026-10-28
goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function `dispatchReadPump` does not checks the option cli `-c`, thus allowing anyone to execute arbitrary command through the use of websockets. Version 1.0.5 fixes the issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
- Guilhem7/CVE-2025-46816POC for exploit of goshsPoC · poc_in_github
affected products (2)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-rwj2-w85g-5cmmgoshs route not protected, allows command execution2025-05-06ghsa · osvUS
### Summary It seems that when running **goshs** without arguments it is possible for anyone to execute commands on the server. This was tested on version **1.0.4** of **goshs**. The command function was introduced in version **0.3.4**. ### Details It seems that the function ```dispatchReadPump``` does not checks the option cli ```-c```, thus allowing anyone to execute arbitrary command through the use of websockets. ### PoC Used **websocat** for the POC: ```bash echo -e '{"type": "command", "content": "id"}' |./websocat 'ws://192.168.1.11:8000/?ws' -t ``` ### Impact The vulnerability will only impacts goshs server on vulnerable versions.
- GO-2025-3672goshs route not protected, allows command execution in github.com/patrickhener/goshs2025-05-15vendor · osvUS
goshs route not protected, allows command execution in github.com/patrickhener/goshs
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-46816cnnvd
- https://github.com/patrickhener/goshs/commit/160220974576afe5111485b8d12fd36058984cfacnnvd
- https://github.com/patrickhener/goshs/releasesPatchcnnvd
- https://github.com/patrickhener/goshs/security/advisories/GHSA-rwj2-w85g-5cmmcnnvd
- https://github.com/patrickhener/goshs/commit/160220974576afe5111485b8d12fd36058984cfaenisa_euvd
- https://github.com/patrickhener/goshs/security/advisories/GHSA-rwj2-w85g-5cmmenisa_euvd
- https://github.com/patrickhener/goshs/commit/160220974576afe5111485b8d12fd36058984cfanvd
- https://github.com/patrickhener/goshs/security/advisories/GHSA-rwj2-w85g-5cmmnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan