CVE-2026-54719

creationtimestamp| type| source ---|---|--- 2026-07-28 22:30:56+00:00| seen| https://gist.github.com/alon710/9b8006195456ffdcd967a102fe0db5d4 2026-07-28 22:35:03+00:00| published-proof-of-concept| https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh 2026-07-29 00:00:29+00:0...

CVE-2026-54719 goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder...