CVE-2026-54719 in goshs
Summary
by MITRE • 07/29/2026
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The goshs HTTP server presents a critical access control vulnerability that undermines the security model designed to protect sensitive files within its directory structure. This flaw specifically affects the bulk download functionality where the ?bulk&file= parameter enables ZIP archive creation and retrieval. The vulnerability stems from the httpserver/updown.go component's bulkDownload handler which fails to properly validate authentication status when processing bulk file requests. Prior to version 2.1.1, this handler bypassed essential security checks that would normally enforce access control lists and custom authentication mechanisms, effectively allowing any remote attacker to download files that should have been restricted by the .goshs folder access control configuration.
The technical implementation flaw manifests in the absence of proper authorization validation within the bulk download workflow. When a user requests a bulk ZIP download, the system should verify that the requesting entity has appropriate permissions to access all files included in the archive based on the directory's ACL settings and block list configurations. However, the bulkDownload handler directly processes file retrieval without invoking the findEffectiveACL function or applyingCustomAuth checks that normally protect individual file access. This represents a direct violation of the principle of least privilege and demonstrates a classic authorization bypass vulnerability that can be categorized under CWE-285, which addresses improper authorization in access control systems.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially expose sensitive data that administrators intended to protect through access control mechanisms. Attackers could exploit this flaw to construct bulk ZIP archives containing files protected by .goshs directory ACLs and block lists, effectively circumventing the intended security boundaries. The vulnerability particularly affects red team environments where goshs serves as a development tool for penetration testers, as it could enable unauthorized access to sensitive test data or configuration files that should remain restricted. This issue represents a regression in security posture since it stems from an incomplete fix for CVE-2026-40189, indicating that the previous remediation efforts were insufficient to address all code paths within the application's access control implementation.
The exploitation of this vulnerability aligns with attack patterns documented in the MITRE ATT&CK framework under techniques related to privilege escalation and defense evasion. Specifically, it maps to T1078 - Valid Accounts and T1566 - Phishing, as attackers could leverage this weakness to gain unauthorized access to protected content through legitimate file download mechanisms. The fix implemented in version 2.1.1 addresses the core issue by ensuring that bulk download operations properly invoke authentication validation functions, thereby restoring proper access control enforcement throughout all code paths. Organizations using goshs should immediately upgrade to version 2.1.1 or later to mitigate this risk, as the vulnerability creates a persistent backdoor for unauthorized file access that could compromise entire directory structures protected by ACL-based security models. The incident highlights the importance of comprehensive testing for access control vulnerabilities and demonstrates how incomplete fixes can leave systems vulnerable to continued exploitation through alternative code paths.