PT-2026-32039 · Goshs · Goshs
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
goshs versions prior to 2.0.0-beta.4
Description
goshs fails to enforce the per-folder
.goshs Access Control List (ACL) and basic authentication mechanism for state-changing routes. While authorization is correctly applied to directory listings and file reads, it is bypassed during operations that modify the server state. An unauthenticated attacker can exploit this to upload files via the PUT method or multipart POST /upload endpoint, create directories using the ?mkdir parameter, and delete files using the ?delete parameter within a protected directory. Furthermore, an attacker can delete the .goshs file itself to remove the folder's authentication policy, subsequently granting unauthorized access to previously protected content. This issue affects confidentiality, integrity, and availability.Recommendations
Update goshs to version 2.0.0-beta.4.
As a temporary mitigation, restrict access to the
PUT method, the /upload endpoint, and the ?mkdir and ?delete parameters.Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Goshs