| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: goshs | Distribution: openSUSE Tumbleweed |
| Version: 2.1.4 | Vendor: openSUSE |
| Release: 1.1 | Build date: Fri Jul 3 16:21:39 2026 |
| Group: Productivity/Networking/Web/Servers | Build host: reproducible |
| Size: 24541556 | Source RPM: goshs-2.1.4-1.1.src.rpm |
| Packager: http://bugs.opensuse.org | |
| Url: https://goshs.de/ | |
| Summary: A simple HTTP server | |
goshs is a replacement for Python's SimpleHTTPServer. It allows uploading and downloading via HTTP/S with either self-signed certificate or user provided certificate and you can use HTTP basic auth.
MIT
* Fri Jul 03 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 2.1.4
Security
* WebDAV --no-delete bypass via MOVE/COPY (GHSA-hq33-8jgp-8qq3)
Under -w --no-delete (and --upload-only), the WebDAV MOVE verb
still removed the source file — a rename deletes it from its
original path — and, with Overwrite: T, destroyed an existing
destination; COPY onto an existing file did the same via an
implicit delete. The mode flags are now enforced on these
verbs: MOVE is rejected whenever deletion is disabled, and a
COPY that would overwrite an existing file is blocked, while a
plain COPY to a new path stays allowed.
- -read-only continues to block all of them.
* SFTP authentication bypass with a single credential
(GHSA-rjrw-mjq6-hpmm)
SFTP only installed its password handler when both a username
and a password were configured, so setting only one left the
server accepting unauthenticated logins. Authentication is now
enforced whenever either credential is set.
New Features
* Clipboard copy in the TUI generator - The --tui reverse-shell
generator can now copy the selected payload straight to your
- clipboard with y/c. It works both locally (xclip/xsel,
wl-copy, pbcopy, clip) and over SSH via OSC 52, filling both
the system clipboard and the X11 primary selection (Ctrl+V and
middle-click / Shift+Insert). The generator tab was also
restructured into a stacked layout so multi-line output can be
cleanly mouse-selected without also grabbing the menu entries.
Bug Fixes
* Fatal port-bind errors under --tui — Every listening protocol
is now bound before the TUI dashboard takes over the terminal,
so a port conflict (or any bind error) is reported cleanly and
is fatal up front — instead of being swallowed by a serving
goroutine, which under --tui left the terminal in raw mode
needing a reset (and was silently dropped entirely for FTP).
* Fri Jun 26 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 2.1.3
New Features
* TFTP server (-tftp / --tftp-server) — goshs can now serve
files over TFTP, the one classic transfer protocol it was
missing (next to HTTP/WebDAV/FTP/SFTP/SMB). Listens on UDP
port 69 by default so built-in clients like Windows' tftp.exe
work out of the box, and supports both downloads (RRQ) and
uploads (WRQ) with blksize/tsize option negotiation. Honors the
IP whitelist and --read-only/--upload-only, rejects path
traversal, and is advertised via mDNS. Hand-rolled with zero
new dependencies.
* Reverse-shell payload generator — A new generator tab in both
the web UI and the --tui dashboard builds reverse-shell
one-liners from a shared payload database (Bash, nc, Python,
PHP, PowerShell, Perl, Ruby, and more), with LHOST/LPORT
substitution and optional URL/Base64 encoding (PowerShell
payloads as -EncodedCommand).
Bug Fixes
* TUI interface display (#187) — In --tui mode without an
explicit -i, the status line now lists every bound interface IP
instead of just showing 0.0.0.0.
* TUI template variables — The status line now reflects every
- -tpl-var KEY=VALUE entry, not only LHOST/LPORT.
* TUI status line — Enabled FTP/SFTP and TFTP servers are now
surfaced in the status bar like the other protocols.
* Config ldap_jndi — The example config shipped a non-binding
ldap_jndi_enabled key; the correct, working key is ldap_jndi.
* Config ldap_wordlist — A ldap_wordlist value set via the
config file was silently ignored; it is now applied.
Packaging
* Shell completions (bash/zsh/fish) updated with the new -tftp /
- -tftp-server / -tftp-port flags.
* Wed Jun 24 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 2.1.2
New Features
* Payload templating — Files can now be rendered as Go templates
on the fly. Request a file with the ?tpl query parameter and
{{.VAR}} placeholders are substituted at download time. Enable
with --template and pass variables via the repeatable
- -tpl-var KEY=VALUE flag (e.g. --tpl-var LPORT=4444). Ideal for
serving payloads/scripts that need host- or port-specific
values baked in without editing files on disk.
* Resumable downloads (HTTP Range support) — The file handler now
honors Range requests, enabling partial content responses and
resumable/interrupted downloads of large files.
Security Fixes
* Bulk-download ACL bypass — Selecting a parent directory for
bulk (zip) download no longer bypasses authentication or block
rules defined in nested .goshs files. ACL is now enforced
per-file during the recursive zip walk, and .goshs files are
excluded from archives.
* WebDAV ACL enforcement — Added a .goshs guard to the WebDAV
interface so directory-level access controls are now applied
over WebDAV as well.
* Brute-force lockout reset — Failed-login lockouts now correctly
reset after the lockout duration expires instead of remaining
stuck.
* Path handling — Removed a double URL-decode in sanitizePath so
filenames containing literal % and + are preserved correctly.
* Share creation crash — Fixed a missing return after a failed
os.Stat in the share handler that could lead to a
nil-dereference, plus a related error-message typo.
Packaging
* Refreshed shell completions (bash/zsh/fish) — added --ttl and
- -tui, and corrected the FTP flag names.
* Makefile cleanup and COPR spec fixes.
* Fixed integration tests.
* Thu Jun 18 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 2.1.1
New Features
* TUI Dashboard (--tui).
* TTL Self-Destruct (--ttl).
Changes
* ConPtyShell no longer embedded in the binary.
* Fri May 29 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 2.1.0
* Address security advisory GHSA-3whc-qvhv-xqjp
* Address security advisory GHSA-j48m-h7xq-2xpj
* Bump github/codeql-action from 4.35.5 to 4.36.0
* Fix issue #166
* General bug fixing and improving security posture.
* Wed May 27 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 2.0.9
* Add FTP/SFTP.
* Fix insecure auth options in FTP Server.
* Fix timing attack surface on ftp password comparison.
* Fixed entropy on cert generation in Cert Serial Number.
* Wed May 13 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 2.0.8
* Add shell completion.
- Update to version 2.0.7
Security
* Security Update: The auto-update check now verifies the
download against MITM attacks using the checksum.
* Fixed GHSA-mxg3-432p-mr72: A mismatched host key during tunnel
setup exits the process immediately instead of silently
continuing.
Bug Fixes
* Fixed SMB credential logging being silently dropped when -b
(basic auth) was active.
* Fixed HTTP collaborator frontend incorrectly parsing certain
base64-encoded log entries.
* Wed Apr 29 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 2.0.6
New Features
* Markdown file preview — View .md files rendered directly in
the browser with syntax highlighting.
* Extended file preview — Added preview support for more data
types (code, documents, etc.).
* Collaborator log export — Export collaborator panel logs
(HTTP, DNS, SMB, LDAP, SMTP) for offline analysis.
Improvements
* Frontend modularization — Restructured monolithic main.js.
* Pretty update changelog — --update now shows changelogs for
all versions between your current and the latest release,
rendered with terminal markdown styling
* Modernized Go code — Applied go fix across the codebase for
updated Go patterns.
* Added highlight.min.js, marked.min.js, and purify.min.js for
frontend rendering.
Bug Fixes
* Fixed broken sharelink handler.
* Removed leftover build artifacts.
* Mon Apr 27 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 2.0.5
* Add LDAP feature.
* Misc dependency updates.
* Sat Apr 25 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 2.0.4
* Add interactive shell catcher, that let's you spawn reverse
shell listeners.
- Update to version 2.0.3
* Lots of bugfixes
* Add a new flag -mu --max-upload that lets you define a max
upload size in bytes.
* Tue Apr 21 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 2.0.2
* Fix security issue GHSA-rhf7-wvw3-vjvm
* Add more tests
- Drop patch:
* gosh-fix-test.patch
* Mon Apr 13 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 2.0.0
Highlights
* SMB server with NTLM hash capture and optional quick hash
cracking.
* DNS server to receive and log incoming DNS queries.
* SMTP server to receive emails and attachments.
* Redirect endpoint for HTTP 3xx redirects with custom headers.
* File-based ACLs for per-directory authentication and access
control.
* Share links with time and download limits, QR codes, and
token-based access WebDAV, SFTP, Basic Auth, Certificate Auth,
Let’s Encrypt, and much more
Security Fixes
* Fix GHSA-7qx6-f23w-3w7f
Unauthenticated Open Redirect, Arbitrary HTTP Response Header
Injection, Missing CSRF, and Invisible-Mode Bypass in goshs
`/?redirect` endpoint
* Fix GHSA-7h3j-592v-jcrp
Public collaborator feed leaks .goshs ACL credentials and
enables unauthorized access.
* Fix GHSA-jrq5-hg6x-j6g3
CSRF in state-changing GET routes enables authenticated file
deletion and directory creation
* Fix GHSA-c29w-qq4m-2gcv
Empty-username SFTP password authentication bypass in goshs
* Fix GHSA-5h6h-7rc9-3824
SFTP root escape via prefix-based path validation in goshs
* Fix CVE-2026-40189 (boo#1261996), GHSA-wvhv-qcqf-f3cx
File-based ACL authorization bypass in goshs state-changing
routes.
* Fix CVE-2026-40188 (boo#1261995), GHSA-2943-crp8-38xx
Missing Write Protection for Parametric Data Values
* Fix CVE-2026-35393 (boo#1261608), GHSA-jg56-wf8x-qrv5
Improper Limitation of a Pathname to a Restricted Directory
('Path Traversal') in goshs POST multipart upload
* Fix CVE-2026-35392 (boo#1261607), GHSA-g8mv-vp7j-qp64
Improper Limitation of a Pathname to a Restricted Directory
('Path Traversal') in goshs PUT Upload
* Fix CVE-2026-35471 (boo#1261609), GHSA-6qcc-6q27-whp8
Improper Limitation of a Pathname to a Restricted Directory
('Path Traversal') in goshs deleteFile()
* Fix GHSA-jgfx-74g2-9r6g
Auth Bypass via Share Token
- Add patch:
* gosh-fix-test.patch
* Sat Mar 14 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 1.1.4
* add a new feature where you can tunnel goshs to localhost.run
to make it available online even if your network can not be
reached directly from the internet.
For more information look at https://localhost.run/.
Bug Fix
* Fixed an upload problem tracked in Issue #134.
* Tue Dec 16 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.1.3
* New Feature: Invisible mode. Read more on that at
https://goshs.de/en/usage/restrictions/index.html#be-invisible-invisible-mode
* made mDNS opt-in instead of opt-out.
* Wed Nov 12 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.1.2
* Fix upload behaviour. Details see issue #128
* Remove Upload form from WebUI when read-only to address issue.
* Mon Sep 22 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.1.1
* You can now disable mDNS.
* Clipboard order is now reversed.
* You can now specify a different upload folder.
* Smaller bugfixes.
- Update to version 1.1.0
New Features
* When using authentication (basic auth or cert auth) you can
now share files using a download limit or a time limit. So
anyone with the link can now download the file (or a folder as
zip file) when clicking the link, even without authentication.
Styleup
* There is now a QRCode generator for general file or folder
links, so you can easily grab files on a mobile device.
* Tue Jun 03 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.1.0
* Feature: When using authentication (basic auth or cert auth)
you can now share files using a download limit or a time limit.
So anyone with the link can now download the file (or a folder
as zip file) when posessing the link.
* Also there is now a QRCode generator for general file or folder
links, so you can easily grab files on a mobile device.
* Thu May 29 2025 Martin Hauke <mardnh@gmx.de>
- Udpate to version 1.0.9
* Add Whitelist function with proxy awareness.
* Wed May 21 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.0.8
- Run tests
- Add patch
* goshs-disable-tests-that-needs-network-access.patch
* Tue May 13 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.0.6
* Sun May 11 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.0.5
* Mon Apr 28 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.0.3
* Fri Mar 07 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.0.2
* Fri Nov 22 2024 Martin Hauke <mardnh@gmx.de>
- Update to version 1.0.1
* Fri Nov 15 2024 Martin Hauke <mardnh@gmx.de>
- Update to version 1.0.0
* Thu Oct 17 2024 Martin Hauke <mardnh@gmx.de>
- Update to version 0.4.2
* Sat Jul 06 2024 Martin Hauke <mardnh@gmx.de>
- Update to version 0.4.0
* Sun Jun 30 2024 Martin Hauke <mardnh@gmx.de>
- Update to version 0.3.9
* Tue Apr 30 2024 Martin Hauke <mardnh@gmx.de>
- Update to version 0.3.8
* Thu Apr 11 2024 Martin Hauke <mardnh@gmx.de>
- Update to version 0.3.7
* Sat Sep 02 2023 Martin Hauke <mardnh@gmx.de>
- Update to version 0.3.6
* Sat Jan 14 2023 Martin Hauke <mardnh@gmx.de>
- Update to version 0.2.0
/usr/bin/goshs /usr/share/bash-completion/completions/goshs.bash /usr/share/doc/packages/goshs /usr/share/doc/packages/goshs/README.md /usr/share/doc/packages/goshs/goshs.json.example /usr/share/fish /usr/share/fish/vendor_completions.d /usr/share/fish/vendor_completions.d/goshs.fish /usr/share/licenses/goshs /usr/share/licenses/goshs/LICENSE /usr/share/zsh /usr/share/zsh/site-functions /usr/share/zsh/site-functions/_goshs
Generated by rpm2html 1.8.1
Fabrice Bellet, Sun Aug 2 05:00:51 2026