Vulnerability Description
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7f
- https://github.com/goshs-labs/goshs/releases/tag/v2.1.1
- https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh
- https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh
FAQ
What is CVE-2026-54719?
CVE-2026-54719 is a vulnerability with a CVSS score of 7.5 (HIGH). goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffective...
How severe is CVE-2026-54719?
CVE-2026-54719 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-54719?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.