CVE-2026-54719

7.5 Élevée

Publiée le 29/07/2026 à 01:17 · Modifiée le 24/10/2026 à 01:10 · Analyse NVD reportée · Source : security-advisories@github.com

Description

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189.

Traduire en français

Produits concernés

goshs-labs goshs

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-862
CWE-863

Références

https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1d
https://github.com/goshs-labs/goshs/releases/tag/v2.1.1
https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh
https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories