| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: goshs | Distribution: openSUSE Tumbleweed |
| Version: 2.0.0 | Vendor: openSUSE |
| Release: 1.1 | Build date: Mon Apr 13 21:37:42 2026 |
| Group: Productivity/Networking/Web/Servers | Build host: reproducible |
| Size: 16544656 | Source RPM: goshs-2.0.0-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://goshs.de/ | |
| Summary: A simple HTTP server | |
goshs is a replacement for Python's SimpleHTTPServer. It allows uploading and downloading via HTTP/S with either self-signed certificate or user provided certificate and you can use HTTP basic auth.
MIT
* Mon Apr 13 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 2.0.0
Highlights
* SMB server with NTLM hash capture and optional quick hash
cracking.
* DNS server to receive and log incoming DNS queries.
* SMTP server to receive emails and attachments.
* Redirect endpoint for HTTP 3xx redirects with custom headers.
* File-based ACLs for per-directory authentication and access
control.
* Share links with time and download limits, QR codes, and
token-based access WebDAV, SFTP, Basic Auth, Certificate Auth,
Let’s Encrypt, and much more
Security Fixes
* Fix GHSA-7qx6-f23w-3w7f
Unauthenticated Open Redirect, Arbitrary HTTP Response Header
Injection, Missing CSRF, and Invisible-Mode Bypass in goshs
`/?redirect` endpoint
* Fix GHSA-7h3j-592v-jcrp
Public collaborator feed leaks .goshs ACL credentials and
enables unauthorized access.
* Fix GHSA-jrq5-hg6x-j6g3
CSRF in state-changing GET routes enables authenticated file
deletion and directory creation
* Fix GHSA-c29w-qq4m-2gcv
Empty-username SFTP password authentication bypass in goshs
* Fix GHSA-5h6h-7rc9-3824
SFTP root escape via prefix-based path validation in goshs
* Fix CVE-2026-40189 (boo#1261996), GHSA-wvhv-qcqf-f3cx
File-based ACL authorization bypass in goshs state-changing
routes.
* Fix CVE-2026-40188 (boo#1261995), GHSA-2943-crp8-38xx
Missing Write Protection for Parametric Data Values
* Fix CVE-2026-35393 (boo#1261608), GHSA-jg56-wf8x-qrv5
Improper Limitation of a Pathname to a Restricted Directory
('Path Traversal') in goshs POST multipart upload
* Fix CVE-2026-35392 (boo#1261607), GHSA-g8mv-vp7j-qp64
Improper Limitation of a Pathname to a Restricted Directory
('Path Traversal') in goshs PUT Upload
* Fix CVE-2026-35471 (boo#1261609), GHSA-6qcc-6q27-whp8
Improper Limitation of a Pathname to a Restricted Directory
('Path Traversal') in goshs deleteFile()
* Fix GHSA-jgfx-74g2-9r6g
Auth Bypass via Share Token
- Add patch:
* gosh-fix-test.patch
* Sat Mar 14 2026 Martin Hauke <mardnh@gmx.de>
- Update to version 1.1.4
* add a new feature where you can tunnel goshs to localhost.run
to make it available online even if your network can not be
reached directly from the internet.
For more information look at https://localhost.run/.
Bug Fix
* Fixed an upload problem tracked in Issue #134.
* Tue Dec 16 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.1.3
* New Feature: Invisible mode. Read more on that at
https://goshs.de/en/usage/restrictions/index.html#be-invisible-invisible-mode
* made mDNS opt-in instead of opt-out.
* Wed Nov 12 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.1.2
* Fix upload behaviour. Details see issue #128
* Remove Upload form from WebUI when read-only to address issue.
* Mon Sep 22 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.1.1
* You can now disable mDNS.
* Clipboard order is now reversed.
* You can now specify a different upload folder.
* Smaller bugfixes.
- Update to version 1.1.0
New Features
* When using authentication (basic auth or cert auth) you can
now share files using a download limit or a time limit. So
anyone with the link can now download the file (or a folder as
zip file) when clicking the link, even without authentication.
Styleup
* There is now a QRCode generator for general file or folder
links, so you can easily grab files on a mobile device.
* Tue Jun 03 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.1.0
* Feature: When using authentication (basic auth or cert auth)
you can now share files using a download limit or a time limit.
So anyone with the link can now download the file (or a folder
as zip file) when posessing the link.
* Also there is now a QRCode generator for general file or folder
links, so you can easily grab files on a mobile device.
* Thu May 29 2025 Martin Hauke <mardnh@gmx.de>
- Udpate to version 1.0.9
* Add Whitelist function with proxy awareness.
* Wed May 21 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.0.8
- Run tests
- Add patch
* goshs-disable-tests-that-needs-network-access.patch
* Tue May 13 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.0.6
* Sun May 11 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.0.5
* Mon Apr 28 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.0.3
* Fri Mar 07 2025 Martin Hauke <mardnh@gmx.de>
- Update to version 1.0.2
* Fri Nov 22 2024 Martin Hauke <mardnh@gmx.de>
- Update to version 1.0.1
* Fri Nov 15 2024 Martin Hauke <mardnh@gmx.de>
- Update to version 1.0.0
* Thu Oct 17 2024 Martin Hauke <mardnh@gmx.de>
- Update to version 0.4.2
* Sat Jul 06 2024 Martin Hauke <mardnh@gmx.de>
- Update to version 0.4.0
* Sun Jun 30 2024 Martin Hauke <mardnh@gmx.de>
- Update to version 0.3.9
* Tue Apr 30 2024 Martin Hauke <mardnh@gmx.de>
- Update to version 0.3.8
* Thu Apr 11 2024 Martin Hauke <mardnh@gmx.de>
- Update to version 0.3.7
* Sat Sep 02 2023 Martin Hauke <mardnh@gmx.de>
- Update to version 0.3.6
* Sat Jan 14 2023 Martin Hauke <mardnh@gmx.de>
- Update to version 0.2.0
/usr/bin/goshs /usr/share/doc/packages/goshs /usr/share/doc/packages/goshs/README.md /usr/share/doc/packages/goshs/goshs.json.example /usr/share/licenses/goshs /usr/share/licenses/goshs/LICENSE
Generated by rpm2html 1.8.1
Fabrice Bellet, Fri Jul 24 15:27:28 2026