CVE-2026-54719 Details
Description
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189.
A vulnerability in Goshs prior to version 2.1.1 allows for unauthenticated reading of files protected by .goshs folder ACLs and block lists. This issue arises from the httpserver/updown.go bulkDownload handler, which for ?bulk&file= ZIP downloads, failed to call findEffectiveACL or applyCustomAuth. As a result, files could be read without authorization, bypassing the intended access controls. The vulnerability exists due to an incomplete fix for a previous authorization issue, leaving a gap in the bulk download route that could be exploited by an attacker.
Users can update to Goshs version 2.1.1 or later, where this vulnerability has been fixed. For those unable to update, it is recommended to disable the bulk download feature or apply stricter access controls to sensitive files.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1d | [email protected] | Source CodeVendor |
| https://github.com/goshs-labs/goshs/releases/tag/v2.1.1 | [email protected] | Release NotesVendor |
| https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| goshs-labs goshs | <= 2.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |