{"id":"GHSA-rmxw-pq4x-3fvh","revision":"36e8f24d181548398c874f5b7f4ea124","records":[{"revision":"36e8f24d181548398c874f5b7f4ea124","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-rmxw-pq4x-3fvh","aliases":["CVE-2026-54719","GO-2026-6133"],"title":"goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)","description":"GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes (PUT/POST upload/?mkdir/?delete) and added recursive ACL resolution, and its description states the read/list path correctly enforces .goshs. That premise does not hold for the ?bulk zip-download route. bulkDownload (httpserver/updown.go) takes one or more ?file= parameters, runs each through sanitizePath(fs.Webroot, file), and streams the contents back as a ZIP without ever calling findEffectiveACL/applyCustomAuth. It is dispatched from earlyBreakParameters (?bulk) before the normal doDir/doFile/sendFile flow that performs the ACL check. An unauthenticated attacker can therefore read any file under the webroot protected solely by a .goshs ACL, bypassing both the folder auth (401 on the normal path) and the per-file block list (404 on the normal path). Same authorization-inconsistency root cause as the original advisory, surviving on a read route the fix did not cover.\n\nProof of concept (live, against the fixed v2.1.0 build which includes fix commit f212c4f4, served with no global -b auth, only a per-folder .goshs):\n  GET /protected/secret.txt              -> 401 (ACL enforced on normal path)\n  GET /protected/secret.txt -u admin:admin -> 200\n  GET /?bulk&file=/protected/secret.txt  -> 200, zip contains the protected file contents  (BYPASS)\n  GET /?bulk&file=/protected/blocked.txt -> 200, zip contains the block-listed file        (block bypass)\n  GET /protected/secret.txt?share        -> 403 'Sharing disabled when auth is disabled'    (correctly gated, NOT a bypass)\n\nImpact: any unauthenticated network attacker can read files an operator protected with the documented per-folder .goshs ACL/basic-auth feature, by requesting them through ?bulk. Confidentiality only (the write/delete equivalents were closed by GHSA-wvhv-qcqf-f3cx). Applies to deployments relying on .goshs as the access boundary (a server-wide -b basic auth, if configured, also gates ?bulk via its middleware).\n\nRemediation: enforce the effective .goshs ACL inside bulkDownload for every requested file exactly as sendFile/processDir do (resolve findEffectiveACL(filepath.Dir(absPath)) + applyCustomAuth + honor acl.Block), or route ?bulk through the same authorization gate as the normal read path. Audit ?cbDown and other alternate read routes for the same gap.\n\nCredit: anir0y (independent security research).","state":0,"publishedAt":"2026-07-28T21:59:48+00:00","modifiedAt":"2026-08-18T15:11:05.0882205+00:00","affected":[{"ecosystem":"Go","name":"github.com/patrickhener/goshs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"1.1.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/patrickhener/goshs/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.1.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"goshs.de/goshs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"1.1.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"goshs.de/goshs/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.1.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh","https://github.com/goshs-labs/goshs/commit/7cf911a26ace737e1a55b7dc073e307a25f7fd1d","https://github.com/goshs-labs/goshs","https://github.com/goshs-labs/goshs/releases/tag/v2.1.1"],"sourceUrl":"https://github.com/advisories/GHSA-rmxw-pq4x-3fvh","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-rmxw-pq4x-3fvh","identifiers":["GHSA-rmxw-pq4x-3fvh","CVE-2026-54719","GO-2026-6133"]},"retained":false,"historicalAffected":[]}],"coverage":[]}