CVE-2026-54719 | CyberRota

CyberRota Analysis

AI-Generated

The bulkDownload handler in goshs prior to version 2.1.1 is vulnerable to unauthenticated file access, allowing attackers to read files that should be protected by ACLs and block lists. This could lead to unauthorized exposure of sensitive data, making it critical for users of goshs, particularly in red teaming and development environments, to upgrade to the latest version immediately to mitigate this risk. Organizations relying on this file server should prioritize patching to prevent potential data breaches.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE

CVE-2026-54719

Severity

HIGH

CVSS

7.5

EPSS

0.28%

Original NVD Description

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189.