CVE-2026-54719CWE-862CWE-863broken-access-control

CVE-2026-54719

High · published July 29, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
39.4
In the wild
Unconfirmed
What it is

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00466 · 39.4th percentile
Weaknesses
CWE-862 · Missing Authorization; CWE-863 · Incorrect Authorization
Published
2026-07-29T03:17Z
References (4)
https://github.com/goshs-labs/goshs/releases/tag/v2.1.1 · [email protected]https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh · [email protected]https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1d · [email protected]
EPSS history
Timeline
  • 28 JUL 21:58Z
    goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)
    cvelistv5