https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T05:06:34.395624+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-342292 EUVD-2026-342292 2026-10-07T05:06:34.443122+00:00 EUVD-2026-342292 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54719 fkie_cve-2026-54719 2026-10-07T05:06:34.443159+00:00

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189.

 https://cve.radiocsirt.org/vuln/ghsa-rmxw-pq4x-3fvh GHSA-rmxw-pq4x-3fvh — goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of G… 2026-10-07T05:06:34.443194+00:00

Affected: Go: github.com/patrickhener/goshs, Go: github.com/patrickhener/goshs/v2, Go: goshs.de/goshs, Go: goshs.de/goshs/v2

GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes (PUT/POST upload/?mkdir/?delete) and added recursive ACL resolution, and its description states the read/list path correctly enforces .goshs. That premise does not hold for the ?bulk zip-download route. bulkDownload (httpserver/updown.go) takes one or more ?file= parameters, runs each through sanitizePath(fs.Webroot, file), and streams the contents back as a ZIP without ever calling findEffectiveACL/applyCustomAuth. It is dispatched from earlyBreakParameters (?bulk) before the normal doDir/doFile/sendFile flow that performs the ACL check. An unauthenticated attacker can therefore read any file under the webroot protected solely by a .goshs ACL, bypassing both the folder auth (401 on the normal path) and the per-file block list (404 on the normal path). Same authorization-inconsistency root cause as the original advisory, surviving on a read route the fix did not cover.

Proof of concept (live, against the fixed v2.1.0 build which includes fix commit f212c4f4, served with no global -b auth, only a per-folder .goshs): GET /protected/secret.txt -> 401 (ACL enforced on normal path) GET /protected/secret.txt -u admin:admin -> 200 GET /?bulk&file=/protected/secret.txt -> 200, zip contains the protected file contents (BYPASS) GET /?bulk&file=/protected/blocked.txt -> 200, zip contains the block-listed file (block bypass) GET /protected/secret.txt?share -> 4…