Executive brief
goshs, a tool for sharing files over HTTP, contains a flaw in its 'share-link' feature. This feature allows users to create links with a specific download limit (e.g., a one-time use link). Due to a synchronization error, multiple people can download the file simultaneously, bypassing the intended limit and potentially allowing unauthorized access to sensitive data if a link is leaked or intercepted.
Technical details
A race condition (CWE-362) exists in the `ShareHandler` component of goshs. The application reads the `DownloadLimit` for a token under a read-lock (`RLock`), releases the lock to serve the file, and only re-acquires a write-lock to increment the `Downloaded` counter after the transfer is complete. This creates a timing window where multiple concurrent goroutines can observe the same pre-increment state, allowing N clients to successfully redeem a link intended for fewer uses. An attacker can exploit this via network requests to exfiltrate data beyond the operator's intended cap. The issue is addressed in version 2.1.0 by moving the counter increment and limit check inside a single atomic lock operation before the file is served.
Affected products
- patrickhener goshs <= 2.0.9
Timeline
- 2026-05-27: disclosed: Vulnerability reproduced by researcher
- 2026-05-28: advisory: GitHub Advisory published by maintainer
- 2026-07-01: patched: Version 2.1.0 released
References
- https://api.github.com/users/black-shadow-007
- https://github.com/black-shadow-007
- https://api.github.com/users/black-shadow-007/gists%7B/gist_id%7D
- https://api.github.com/users/black-shadow-007/repos
- https://avatars.githubusercontent.com/u/205796698?v=4
- https://api.github.com/users/black-shadow-007/events%7B/privacy%7D