High severity7.5NVD Advisory· Published Jul 28, 2026· Updated Jul 30, 2026
CVE-2026-54719
CVE-2026-54719
Description
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/patrickhener/goshsGo | <= 1.1.4 | — |
github.com/patrickhener/goshs/v2Go | < 2.1.1 | 2.1.1 |
goshs.de/goshsGo | <= 1.1.4 | — |
goshs.de/goshs/v2Go | < 2.1.1 | 2.1.1 |
Affected products
2- osv-coordsRange: < 0.0.20260827T195228-160000.1.1
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.