Most recent entries from all

EUVD-2026-291052

fkie_cve-2026-40189

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload files with PUT, upload files with multipart POST /upload, create directories with ?mkdir, and delete files with ?delete inside a .goshs-protected directory. By deleting the .goshs file itself, the attacker can remove the folder's auth policy and then access previously protected content without credentials. This results in a critical authorization bypass affecting confidentiality, integrity, and availability. This vulnerability is fixed in 2.0.0-beta.4.

GHSA-wvhv-qcqf-f3cx — goshs has a file-based ACL authorization bypass in goshs state-changing routes

Affected: Go: github.com/patrickhener/goshs

### Summary goshs enforces the documented per-folder `.goshs` ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload files with `PUT`, upload files with multipart `POST /upload`, create directories with `?mkdir`, and delete files with `?delete` inside a `.goshs`-protected directory. By deleting the `.goshs` file itself, the attacker can remove the folder's auth policy and then access previously protected content without credentials. This results in a critical authorization bypass affecting confidentiality, integrity, and availability.

### Details The project README explicitly documents file-based ACLs as a security feature:

- `README.md:59` - "You can place a .goshs in any folder to apply custom ACLs" - `README.md:61` - "You can apply custom basic auth per folder"

The read/list path correctly enforces `.goshs`:

- `httpserver/filebased.go:10-49` loads `.goshs` - `httpserver/handler.go:68-91` calls `findSpecialFile()` for directories - `httpserver/handler.go:94-101` calls `findSpecialFile()` for files - `httpserver/handler.go:285-305` applies custom auth - `httpserver/handler.go:545-565` enforces folder auth during directory rendering - `httpserver/handler.go:590-630` enforces file auth and blocked entries during file serving

However, the state-changing routes bypass this logic entirely:

- `httpserver/server.go:94-100` routes multipart `POST /.…

openSUSE-SU-2026:10542-1 — goshs-2.0.0-1.1 on GA media

goshs-2.0.0-1.1 on GA media