Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

goshs lets anyone download protected files

CVE-2026-54719 · published 3 months ago
Summary

Versions of goshs before 2.1.1 let users bypass folder access controls when using the bulk download feature, exposing files that should be private. This means an attacker could retrieve restricted data without logging in. Upgrade to goshs 2.1.1 or later to close the gap.

What to do
  • Update github.com patrickhener to version 2.1.1.
  • Update goshs.de goshs to version 2.1.1.
Affected software
Ecosystem VendorProductAffected versions
– goshs-labs goshs < 2.1.1
go github.com patrickhener <= 1.1.4
go github.com patrickhener <= 2.1.0
Fix: upgrade to 2.1.1
go goshs.de goshs <= 1.1.4
go goshs.de goshs <= 2.1.0
Fix: upgrade to 2.1.1
Original advisory text
goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
CWE-863Incorrect Authorization
Timeline
Published28 Jul 2026
Updated4 Nov 2026
First seen28 Jul 2026
Sources
CVE-2026-54719 · NVD
CVE-2026-54719 · MITRE
GHSA-rmxw-pq4x-3fvh · GHSA
CVE-2026-54719 · OSV
Track software like this
Free during beta