DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54719: CVE-2026-54719: Access Control List Authorization Bypass in goshs via bulk ZIP Download Route

#security #cve #cybersecurity

CVE-2026-54719: Access Control List Authorization Bypass in goshs via bulk ZIP Download Route

Vulnerability ID: CVE-2026-54719
CVSS Score: 7.5
Published: 2026-07-28

CVE-2026-54719 is a high-severity Access Control List (ACL) authorization bypass vulnerability in goshs, a lightweight HTTPS-capable server used for file sharing. The issue allows unauthenticated network attackers to completely bypass file-level and directory-level authentication mechanisms and blocklists by requesting protected resources via the bulk ZIP-download route (?bulk). This vulnerability represents a residual flaw following a partial remediation attempt for CVE-2026-40189.

TL;DR

Unauthenticated network attackers can completely bypass directory-level basic authentication and file blocklists in goshs by requesting protected files via the ?bulk ZIP-download route. This flaw is resolved in version 2.1.1.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-862, CWE-863
  • Attack Vector: Network
  • CVSS Base Score: 7.5 (High)
  • EPSS Score: 0.00% (Insufficient telemetry data)
  • Impact: Unauthenticated arbitrary file read under the server's webroot
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • goshs (goshs-labs)
  • goshs: < 2.1.1 (Fixed in: v2.1.1)

Code Analysis

Commit: 7cf911a

Implement ACL check and blocklist check within the bulkDownload routine to prevent unauthenticated file reads

Exploit Details

  • Official Advisory: Advisory containing detailed reproduction steps and explanation of the bulk download route vulnerability.

Mitigation Strategies

  • Upgrade goshs to version 2.1.1 or newer
  • Apply global basic authentication via the server's command-line configuration arguments (-b)
  • Block bulk-download query parameters using a reverse proxy or Web Application Firewall (WAF)

Remediation Steps:

  1. Audit all deployed goshs systems to identify instances running versions prior to 2.1.1
  2. Download and compile goshs version 2.1.1 or pull the updated release binary from the official repository
  3. If updating cannot be completed immediately, modify reverse proxy configurations to intercept and drop HTTP requests containing the '?bulk' query parameter
  4. Deploy global basic authentication configuration keys to ensure all requests undergo centralized validation before routing

References

Read the full report for CVE-2026-54719 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)