Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2025-46816
CVE-2025-46816:
vulnerability analysis and mitigation
Overview
goshs, a SimpleHTTPServer written in Go, contains a critical remote code execution vulnerability (CVE-2025-46816) discovered and disclosed on May 6, 2025. The vulnerability affects versions 0.3.4 through 1.0.4, allowing unauthenticated users to execute arbitrary commands on the server when running goshs without arguments (Wiz Report, NVD).
Technical details
The vulnerability stems from the dispatchReadPump function not properly checking the command-line option -c, which enables unauthorized command execution through websockets. The vulnerability has been assigned a CVSS v3.0 base score of 9.4 (Critical) with the vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. The weakness has been categorized under CWE-284 (Improper Access Control) and CWE-77 (Command Injection) (GitHub Advisory, NVD).
Impact
The vulnerability allows remote attackers to execute arbitrary commands on affected goshs servers without authentication. This results in high impact on both confidentiality and integrity of the system, with a lower impact on availability (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been fixed in version 1.0.5 of goshs. Users are advised to upgrade to this version to mitigate the risk (NVD).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management