Executive brief
goshs, a tool for serving files over HTTP, contains a security flaw that allows unauthorized access to restricted files. By adding a trailing slash to a web request, an attacker can bypass the software's block list and access sensitive configuration files, including those containing administrative password hashes. This could lead to the exposure of private data and internal security credentials.
Technical details
The vulnerability exists in the `sendFile` handler within `httpserver/handler.go`. The function derives the filename for authorization checks from the raw request path (`req.URL.Path`), but opens the file using a cleaned path (`filepath.Clean`). When a trailing slash is appended to the request, the derived filename becomes an empty string, which fails to trigger the 'never-serve' rule for the `.goshs` ACL file and bypasses the `acl.Block` list. An attacker can exploit this to retrieve restricted files, including the ACL file containing bcrypt password hashes. Authentication itself is not bypassed; however, files intended to be blocked by the ACL are exposed. The issue is addressed in version 2.1.5-0.20260727065949-f3ef599e4091.
Affected products
- patrickhener goshs <= 1.1.4
- patrickhener goshs/v2 <= 2.1.4
- goshs.de goshs <= 1.1.4
- goshs.de goshs/v2 <= 2.1.4
Timeline
- 2026-07-27: patched: Fix committed to repository
- 2026-07-28: advisory: GitHub Advisory published