Skip to content
OpenAdvisories

Vendor

goshs-labs

5 known vulnerabilities.

Products

goshs 5
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-54719

    goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)

    goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of f…

    goshs-labs goshs github.com/patrickhener/goshs github.com/patrickhener/goshs/v2 Go