CVE-2026-54719

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.1.1

Description The bulkDownload handler in httpserver/updown.go fails to call findEffectiveACL or applyCustomAuth when processing ZIP downloads via the ?bulk&file= parameter. This allows an unauthenticated network attacker to read files under the webroot that are protected solely by .goshs folder Access Control Lists (ACLs) or block lists. The issue occurs because the ?bulk parameter is dispatched via earlyBreakParameters before the standard authorization flow is executed, bypassing both folder authentication and per-file block lists.

Recommendations Update to version 2.1.1. As a temporary mitigation, restrict access to the ?bulk parameter in the affected API endpoint until the update is applied.