CVE-2026-50139

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.0.10

Description A race condition exists in the ShareHandler when processing share-link redemptions. The system reads the DownloadLimit of a share token using a read lock, releases it to serve the file, and only then re-acquires a write lock to increment the download counter. This allows multiple concurrent requests to read the same limit snapshot and pass the check simultaneously, enabling users to exceed the intended download cap. This issue is triggered via the ?token= parameter in the share-link endpoint.

Recommendations Update to a version newer than 2.0.9. As a temporary mitigation, avoid using the DownloadLimit feature for highly sensitive one-shot secrets until the software is updated.