PT-2026-65622 · Goshs · Goshs

CVE-2026-54719 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.1.1

Description The bulkDownload handler in httpserver/updown.go fails to call findEffectiveACL or applyCustomAuth when processing ZIP downloads via the ?bulk&file= parameter. This allows an unauthenticated network attacker to read files under the webroot that are protected solely by .goshs folder Access Control Lists (ACLs) or block lists. The issue occurs because the ?bulk parameter is dispatched via earlyBreakParameters before the standard authorization flow is executed, bypassing both folder authentication and per-file block lists.

Recommendations Update to version 2.1.1. As a temporary mitigation, restrict access to the ?bulk parameter in the affected API endpoint until the update is applied.

Fix

Incorrect Authorization

Missing Authorization

Weakness Enumeration

CWE-863

CWE-862

Related Identifiers

CVE-2026-54719

GHSA-RMXW-PQ4X-3FVH

Affected Products

Goshs

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-54719 · Security Note
• https://osv.dev/vulnerability/GHSA-rmxw-pq4x-3fvh · Vendor Advisory
• https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1d · Note
• https://github.com/goshs-labs/goshs/releases/tag/v2.1.1 · Note
• https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh · Note
• https://github.com/goshs-labs/goshs · Note