# CVE-2026-50139: patrickhener goshs race condition in share-link download limit

Source: https://junglewise.ai/threats/cve-2026-50139-patrickhener-goshs-race-condition-in-share-link-download-limit  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-50139 · Severity: medium · CVSS 5.9 · Published 2026-08-18

goshs, a tool for sharing files over HTTP, contains a flaw in its 'share-link' feature. This feature allows users to create links with a specific download limit (e.g., a one-time use link). Due to a synchronization error, multiple people can download the file simultaneously, bypassing the intended limit and potentially allowing unauthorized access to sensitive data if a link is leaked or intercepted.

Technologies: [goshs.de/goshs (Go)](https://junglewise.ai/threats/technologies/goshs-de-goshs), [goshs.de/goshs/v2 (Go)](https://junglewise.ai/threats/technologies/goshs-de-goshs-v2). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-50139 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50139 being exploited in the wild.

**How severe is CVE-2026-50139?** Medium severity, with a CVSS score of 5.9, published 18 August 2026.

**Which products and versions are affected?** goshs.de/goshs (Go) SEMVER:introduced=0; goshs.de/goshs/v2 (Go) <= 2.0.9, SEMVER:introduced=0,fixed=2.1.0.

**Is there a fix for CVE-2026-50139?** Yes. goshs.de/goshs/v2 (Go): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50139 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50139?** Check whether you run goshs.de/goshs (Go) or goshs.de/goshs/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- goshs.de/goshs/v2 (Go): upgrade to 2.1.0 or later

  ```sh
  go get goshs.de/goshs/v2@v2.1.0
  ```


## Technical details

A race condition (CWE-362) exists in the `ShareHandler` component of goshs. The application reads the `DownloadLimit` for a token under a read-lock (`RLock`), releases the lock to serve the file, and only re-acquires a write-lock to increment the `Downloaded` counter after the transfer is complete. This creates a timing window where multiple concurrent goroutines can observe the same pre-increment state, allowing N clients to successfully redeem a link intended for fewer uses. An attacker can exploit this via network requests to exfiltrate data beyond the operator's intended cap. The issue is addressed in version 2.1.0 by moving the counter increment and limit check inside a single atomic lock operation before the file is served.

## Affected products

- patrickhener goshs <= 2.0.9

## Identifiers

- CVE-2026-50139
- GHSA-j48m-h7xq-2xpj
- GO-2026-5881

## Timeline

- 2026-05-27: disclosed: Vulnerability reproduced by researcher
- 2026-05-28: advisory: GitHub Advisory published by maintainer
- 2026-07-01: patched: Version 2.1.0 released

## References

- [https://api.github.com/users/black-shadow-007](https://api.github.com/users/black-shadow-007)
- [https://github.com/black-shadow-007](https://github.com/black-shadow-007)
- [https://api.github.com/users/black-shadow-007/gists%7B/gist_id%7D](https://api.github.com/users/black-shadow-007/gists%7B/gist_id%7D)
- [https://api.github.com/users/black-shadow-007/repos](https://api.github.com/users/black-shadow-007/repos)
- [https://avatars.githubusercontent.com/u/205796698?v=4](https://avatars.githubusercontent.com/u/205796698?v=4)
- [https://api.github.com/users/black-shadow-007/events%7B/privacy%7D](https://api.github.com/users/black-shadow-007/events%7B/privacy%7D)

## Related threats

- [patrickhener goshs access control bypass in WebDAV listener](https://junglewise.ai/threats/cve-2026-50138-patrickhener-goshs-access-control-bypass-in-webdav-listener)
- [goshs-labs goshs ACL bypass via trailing slash in sendFile handler](https://junglewise.ai/threats/cve-2026-66064-goshs-labs-goshs-acl-bypass-via-trailing-slash-in-sendfile)
- [goshs path traversal in multipart upload handler](https://junglewise.ai/threats/cve-2026-66063-goshs-path-traversal-in-multipart-upload-handler)
- [goshs WebDAV deletion bypass via MOVE and COPY methods](https://junglewise.ai/threats/cve-2026-64863-goshs-webdav-deletion-bypass-via-move-and-copy-methods)
- [goshs SFTP authentication bypass via empty password handler logic](https://junglewise.ai/threats/cve-2026-62325-goshs-sftp-authentication-bypass-via-empty-password-handler-logic)