Answer in brief
CVE-2026-54719 records a High severity missing auth vulnerability in goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx). The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
Answer in brief
CVE-2026-54719 records a High severity missing auth vulnerability in goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx). The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
Update github.com/patrickhener/goshs/v2 to 2.1.1; goshs.de/goshs/v2 to 2.1.1 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanMissing Auth describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-54719 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/patrickhener/goshsgo | <=1.1.4 | Not reported |
| github.com/patrickhener/goshs/v2go | <=2.1.0 | 2.1.1 |
| goshs.de/goshsgo | <=1.1.4 | Not reported |
| goshs.de/goshs/v2go | <=2.1.0 | 2.1.1 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-54719 records a High severity missing auth vulnerability in goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx). The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2, goshs.de/goshs.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate github.com/patrickhener/goshs/v2 to 2.1.1; goshs.de/goshs/v2 to 2.1.1 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanMissing Auth describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-54719 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/patrickhener/goshsgo | <=1.1.4 | Not reported |
| github.com/patrickhener/goshs/v2go | <=2.1.0 | 2.1.1 |
| goshs.de/goshsgo | <=1.1.4 | Not reported |
| goshs.de/goshs/v2go | <=2.1.0 | 2.1.1 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-54719 records a High severity missing auth vulnerability in goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx). The source record does not mark it as known exploited. 4 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2, goshs.de/goshs.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardGHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes (PUT/POST upload/?mkdir/?delete) and added recursive ACL resolution, and its description states the read/list path correctly enforces .goshs. That premise does not hold for the ?bulk zip-download route. bulkDownload (httpserver/updown.go) takes one or more ?file= parameters, runs each through sanitizePath(fs.Webroot, file), and streams the contents back as a ZIP without ever calling findEffectiveACL/applyCustomAuth. It is dispatched from earlyBreakParameters (?bulk) before the normal doDir/doFile/sendFile flow that performs the ACL check. An unauthenticated attacker can therefore read any file under the webroot protected solely by a .goshs ACL, bypassing both the folder auth (401 on the normal path) and the per-file block list (404 on the normal path). Same authorization-inconsistency root cause as the original advisory, surviving on a read route the fix did not cover. Proof of concept (live, against the fixed v2.1.0 build which includes fix commit f212c4f4, served with no global -b auth, only a per-folder .goshs): GET /protected/secret.txt -> 401 (ACL enforced on normal path) GET /protected/secret.txt -u admin:admin -> 200 GET /?bulk&file=/protected/secret.txt -> 200, zip contains the protected file contents (BYPASS) GET /?bulk&file=/protected/blocked.txt -> 200, zip contains the block-listed file (block bypass) GET /protected/secret.txt?share -> 403 'Sharing disabled when auth is disabled' (correctly gated, NOT a bypass) Impact: any unauthenticated network attacker can read files an operator protected with the documented per-folder .goshs ACL/basic-auth feature, by requesting them through ?bulk. Confidentiality only (the write/delete equivalents were closed by GHSA-wvhv-qcqf-f3cx). Applies to deployments relying on .goshs as the access boundary (a server-wide -b basic auth, if configured, also gates ?bulk via its middleware). Remediation: enforce the effective .goshs ACL inside bulkDownload for every requested file exactly as sendFile/processDir do (resolve findEffectiveACL(filepath.Dir(absPath)) + applyCustomAuth + honor acl.Block), or route ?bulk through the same authorization gate as the normal read path. Audit ?cbDown and other alternate read routes for the same gap. Credit: anir0y (independent security research).
GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes (PUT/POST upload/?mkdir/?delete) and added recursive ACL resolution, and its description states the read/list path correctly enforces .goshs. That premise does not hold for the ?bulk zip-download route. bulkDownload (httpserver/updown.go) takes one or more ?file= parameters, runs each through sanitizePath(fs.Webroot, file), and streams the contents back as a ZIP without ever calling findEffectiveACL/applyCustomAuth. It is dispatched from earlyBreakParameters (?bulk) before the normal doDir/doFile/sendFile flow that performs the ACL check. An unauthenticated attacker can therefore read any file under the webroot protected solely by a .goshs ACL, bypassing both the folder auth (401 on the normal path) and the per-file block list (404 on the normal path). Same authorization-inconsistency root cause as the original advisory, surviving on a read route the fix did not cover. Proof of concept (live, against the fixed v2.1.0 build which includes fix commit f212c4f4, served with no global -b auth, only a per-folder .goshs): GET /protected/secret.txt -> 401 (ACL enforced on normal path) GET /protected/secret.txt -u admin:admin -> 200 GET /?bulk&file=/protected/secret.txt -> 200, zip contains the protected file contents (BYPASS) GET /?bulk&file=/protected/blocked.txt -> 200, zip contains the block-listed file (block bypass) GET /protected/secret.txt?share -> 403 'Sharing disabled when auth is disabled' (correctly gated, NOT a bypass) Impact: any unauthenticated network attacker can read files an operator protected with the documented per-folder .goshs ACL/basic-auth feature, by requesting them through ?bulk. Confidentiality only (the write/delete equivalents were closed by GHSA-wvhv-qcqf-f3cx). Applies to deployments relying on .goshs as the access boundary (a server-wide -b basic auth, if configured, also gates ?bulk via its middleware). Remediation: enforce the effective .goshs ACL inside bulkDownload for every requested file exactly as sendFile/processDir do (resolve findEffectiveACL(filepath.Dir(absPath)) + applyCustomAuth + honor acl.Block), or route ?bulk through the same authorization gate as the normal read path. Audit ?cbDown and other alternate read routes for the same gap. Credit: anir0y (independent security research).