CVE-2026-54719: goshs Auth Bypass Vulnerability

CVE-2026-54719 Overview

CVE-2026-54719 is a missing authorization vulnerability [CWE-862] in goshs, a single-binary file server used by red teamers and developers. Versions prior to 2.1.1 fail to enforce Access Control Lists (ACLs) and block lists on the bulk ZIP download endpoint. The bulkDownload handler in httpserver/updown.go processes ?bulk&file= requests without invoking findEffectiveACL or applyCustomAuth. Unauthenticated remote attackers can read files that administrators intended to protect through .goshs folder ACLs. The issue is a regression from an incomplete fix for CVE-2026-40189 and was corrected in version 2.1.1.

Critical Impact
Unauthenticated network attackers can retrieve ACL-protected files from any exposed goshs instance by requesting them through the bulk ZIP download parameter.

Affected Products

goshs versions prior to 2.1.1
Deployments relying on .goshs folder ACLs for file protection
Deployments relying on custom authentication (applyCustomAuth) for path restrictions

Discovery Timeline

2026-07-28 - CVE-2026-54719 published to the National Vulnerability Database (NVD)
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-54719

Vulnerability Analysis

The goshs server exposes multiple download paths, including a bulk ZIP endpoint invoked with ?bulk&file= query parameters. Standard file requests route through authorization checks that consult .goshs folder ACLs and any configured custom authentication middleware. The bulkDownload handler in httpserver/updown.go bypassed both checks and streamed requested paths directly into a ZIP archive.

An unauthenticated attacker who can reach the server over the network sends a crafted request naming one or more protected files. The handler reads each file from disk and appends it to the response archive, returning content the ACL layer would otherwise deny. The vulnerability affects only confidentiality; integrity and availability are not directly impacted.

Root Cause

The root cause is missing authorization enforcement on a secondary code path. The primary file handler correctly delegates to findEffectiveACL and applyCustomAuth, but the bulk ZIP handler was implemented without these calls. This constitutes an incomplete fix for CVE-2026-40189, which addressed similar authorization gaps in adjacent handlers.

Attack Vector

The attack requires network reachability to the goshs instance and no authentication, credentials, or user interaction. An attacker issues an HTTP GET to the target with ?bulk&file= referencing paths protected by ACL rules. The server returns a ZIP archive containing the requested files.

// Patch import addition in httpserver/updown.go (v2.1.1)
 	"net/http"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"time"

Source: GitHub Commit 7cf911a. The full patch adds ACL and custom authentication checks to the bulkDownload handler so that protected paths are filtered before being written into the response archive.

Detection Methods for CVE-2026-54719

Indicators of Compromise

HTTP requests containing the query string ?bulk&file= targeting paths that appear in .goshs ACL definitions.
Successful HTTP 200 responses from goshs with Content-Type: application/zip returned to clients that never authenticated.
Access log entries for the bulk download endpoint from unexpected external IP addresses.

Detection Strategies

Parse goshs HTTP access logs and correlate bulk download requests against the ACL configuration to identify authorization bypass attempts.
Deploy a web application firewall (WAF) rule that inspects ?bulk&file= parameters and blocks requests referencing sensitive path prefixes.
Compare running binary versions against the fixed release tag v2.1.1 across all hosts to inventory exposure.

Monitoring Recommendations

Alert on any outbound ZIP transfer from a goshs process to an unauthenticated session originating outside trusted networks.
Baseline typical goshs request volume and flag spikes in bulk download requests, which are common during data exfiltration.
Forward goshs logs to a centralized data lake for retrospective search once the CVE became public.

How to Mitigate CVE-2026-54719

Immediate Actions Required

Upgrade all goshs instances to version 2.1.1 or later, available from the GitHub Release v2.1.1 page.
Audit .goshs ACL configurations and review access logs for prior bulk download requests targeting protected paths.
Restrict network exposure of goshs instances to trusted segments until patching is verified.

Patch Information

The fix is delivered in goshs version 2.1.1. The relevant commit adds ACL and custom authentication enforcement to the bulkDownload handler in httpserver/updown.go. See the GitHub Security Advisory GHSA-rmxw-pq4x-3fvh for advisory details and the patch commit for code changes.

Workarounds

Place goshs behind a reverse proxy that strips or rejects the bulk query parameter until the upgrade is applied.
Bind the server to loopback or an internal interface and expose it only through an authenticating tunnel.
Remove sensitive files from directories served by goshs and rely on filesystem permissions rather than .goshs ACLs for confidentiality.

bash

# Example reverse-proxy rule blocking the vulnerable endpoint until patched
# nginx snippet: reject any request that contains the bulk parameter
if ($args ~* "(^|&)bulk(=|&|$)") {
    return 403;
}