Executive brief
goshs is a file server used by developers and security professionals to share files. A security flaw allows unauthorized users to download files that were supposed to be protected by access control lists (ACLs) or block lists. By using the bulk download feature, an attacker can bypass security checks and access sensitive data without a password. This issue has been resolved in version 2.1.1.
Technical details
The bulkDownload handler in `httpserver/updown.go` fails to implement authorization checks when processing ZIP download requests via the `?bulk&file=` parameter. While standard file access routes correctly enforce `.goshs` folder ACLs and block lists by calling `findEffectiveACL` and `applyCustomAuth`, the bulk download path bypasses these checks entirely. This allows a remote, unauthenticated attacker to read any file within the webroot, even if it is explicitly protected or blocked by local configuration. This vulnerability is a residual issue following an incomplete fix for a previous authorization bypass (CVE-2026-40189). The issue is addressed in version 2.1.1 by ensuring ACL enforcement is applied to the bulk download route.
Affected products
- goshs-labs goshs < 2.1.1
Timeline
- 2026-06-08: advisory: GitHub Security Advisory GHSA-rmxw-pq4x-3fvh published
- 2026-06-09: patched: Fix committed to repository
- 2026-06-17: patched: Version 2.1.1 released
- 2026-07-28: disclosed: CVE-2026-54719 published to NVD