High severityNVD Advisory· Published Jul 28, 2026· Updated Jul 29, 2026
goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)
CVE-2026-54719
Description
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/patrickhener/goshsGo | <= 1.1.4 | — |
github.com/patrickhener/goshs/v2Go | < 2.1.1 | 2.1.1 |
goshs.de/goshsGo | <= 1.1.4 | — |
goshs.de/goshs/v2Go | < 2.1.1 | 2.1.1 |
Affected products
1Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-rmxw-pq4x-3fvhghsaADVISORY
- github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1dghsax_refsource_MISCWEB
- github.com/goshs-labs/goshs/releases/tag/v2.1.1ghsax_refsource_MISCWEB
- github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvhghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.