Goshs - CraftedSignal Threat Feed

Goshs File-Based ACL Authorization Bypass via Bulk Zip Download

hello@craftedsignal.io — Tue, 28 Jul 2026 22:01:08 +0000

A high-severity authorization bypass vulnerability, tracked as CVE-2026-54719, has been identified in goshs (versions <= 1.1.4) and goshs/v2 (versions <= 2.1.0) which allows unauthenticated attackers to read arbitrary files. This flaw is a residual vulnerability from a previous fix (GHSA-wvhv-qcqf-f3cx) which addressed ACL bypasses on state-changing routes but failed to cover the ?bulk zip-download endpoint. The bulkDownload function, invoked by requests containing ?bulk and ?file= parameters, retrieves file contents as a ZIP archive without performing the necessary .goshs ACL checks or honoring per-file block lists. This critical oversight enables any unauthenticated network attacker to bypass folder-level and file-level access controls, leading to unauthorized disclosure of confidential information from files located under the webroot. The vulnerability does not affect write or delete operations, limiting the impact to confidentiality only.

Attack Chain

An unauthenticated attacker identifies a vulnerable goshs instance exposed on the network.
The attacker attempts to access a known protected file directly (e.g., GET /protected/secret.txt), which is correctly denied with a 401 Unauthorized response by the server's standard authorization flow.
The attacker then crafts a malicious HTTP GET request targeting the ?bulk zip-download route, appending the ?file= parameter with the path to the desired protected file (e.g., GET /?bulk&file=/protected/secret.txt).
The goshs server receives this request and routes it to the bulkDownload function, bypassing the normal authorization gates.
The bulkDownload function processes the ?file= parameter, retrieves the content of /protected/secret.txt, and streams it back to the attacker within a ZIP archive.
The attacker extracts the ZIP archive to obtain the contents of the confidential file, completely circumventing the .goshs ACL protections and any per-file block lists.

Impact

Successful exploitation of CVE-2026-54719 leads to unauthorized information disclosure, specifically the confidentiality of any file stored under the goshs webroot that relies solely on .goshs ACLs for protection. While a server-wide basic authentication mechanism (-b flag) would still gate the ?bulk route, deployments relying on per-folder .goshs ACLs are vulnerable. Attackers can exfiltrate sensitive data such as configuration files, user data, or intellectual property without any authentication, posing a significant risk to data privacy and security. The vulnerability does not allow for data modification or deletion.

Recommendation

Deploy the Sigma rule Detects CVE-2026-54719 Exploitation - Goshs bulk download ACL bypass to your SIEM to identify attempts to exploit this vulnerability.
Monitor web server access logs for GET requests to /?bulk containing the file= parameter, as these indicate potential exploitation attempts.
Apply the latest security patches from goshs developers immediately, which should enforce .goshs ACLs within the bulkDownload function or route ?bulk requests through the same authorization gate as normal read paths.
Conduct an audit of other alternate read routes such as ?cbDown within your goshs deployments for similar authorization bypass gaps.

goshs SSH Tunnel Vulnerable to MITM via Insecure Host Key Handling

hello@craftedsignal.io — Fri, 15 May 2026 17:19:20 +0000

The goshs application, prior to version 2.0.7, is vulnerable to a man-in-the-middle (MITM) attack when using the --tunnel or -t flag. The application opens an outbound SSH connection to localhost.run:22 with host key verification disabled via ssh.InsecureIgnoreHostKey(). This insecure configuration allows an attacker positioned on the network path to intercept the TCP connection, present their own SSH host key, and proxy the connection. Because localhost.run performs TLS termination, the attacker can read and rewrite all HTTP request and response content in plaintext. This vulnerability allows for the exfiltration of sensitive data and modification of served content.

Attack Chain

A user executes goshs --tunnel to create a tunnel.
tunnel.Start() initiates an SSH connection to localhost.run:22 with InsecureIgnoreHostKey().
An attacker, positioned on the network path, intercepts the TCP connection to localhost.run:22 and responds with a malicious SSH server.
The malicious SSH server presents a fake SSH host key, which the goshs client accepts due to the disabled host key verification.
The attacker proxies the SSH session onward to the real localhost.run:22 to retrieve the public URL.
All subsequent HTTP requests to the public URL are routed through the attacker's proxy.
The attacker intercepts all HTTP requests and responses, reading sensitive data such as URLs, headers, authentication credentials, and file contents.
The attacker can modify HTTP responses, inject malicious content, or redirect requests.

Impact

The vulnerability can lead to significant data breaches and compromise of system integrity. All HTTP request and response content, including sensitive information such as URLs, headers, basic authentication credentials, file contents, and share-link tokens, can be read by the attacker. Furthermore, attackers can modify responses in transit, replacing served files, injecting malicious scripts, or substituting binaries with backdoored versions. This poses a high risk to both the confidentiality and integrity of the data being transmitted through the goshs tunnel.

Recommendation

Upgrade to goshs version 2.0.7 or later to benefit from the fix that replaces ssh.InsecureIgnoreHostKey() with a TOFU host key verification mechanism.
Monitor network traffic for connections to localhost.run:22 originating from goshs processes to detect potential MITM attempts, using the provided Sigma rule.
Regularly inspect the ~/.config/goshs/known_hosts file to ensure the host key for localhost.run:22 has not been tampered with (after upgrading).

goshs SimpleHTTPServer SFTP Rename Path Traversal Vulnerability (CVE-2026-40188)

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

goshs is a SimpleHTTPServer written in Go. Versions 1.0.7 to before 2.0.0-beta.4 are vulnerable to a path traversal issue (CVE-2026-40188) within the SFTP rename command. This vulnerability arises because the application only sanitizes the source path during a rename operation, neglecting to sanitize the destination path. This oversight allows authenticated attackers with low privileges to manipulate file paths and potentially write files outside the designated SFTP root directory, leading to unauthorized file creation or modification. The vulnerability is resolved in version 2.0.0-beta.4. This vulnerability poses a risk to systems using vulnerable versions of goshs for file sharing.

Attack Chain

Attacker gains low-privilege access to the goshs server via SSH or other means.
Attacker establishes an SFTP session with the vulnerable goshs server.
Attacker identifies a file or directory within their authorized SFTP root.
Attacker crafts an SFTP rename command where the source is a legitimate file within their SFTP root.
The attacker crafts the destination path of the rename command to include path traversal sequences (e.g., "../") to move outside of the intended root directory.
The vulnerable goshs server executes the rename command using the attacker-controlled destination path without proper sanitization.
The attacker successfully creates or overwrites files in unauthorized locations on the server's file system.
The attacker may leverage the ability to write arbitrary files to achieve persistence by modifying system configuration files.

Impact

Successful exploitation of this vulnerability allows attackers to bypass intended access restrictions and potentially overwrite critical system files, leading to code execution or denial-of-service. The impact is high due to the potential for privilege escalation and system compromise. While the exact number of vulnerable installations is unknown, any organization using goshs versions 1.0.7 to before 2.0.0-beta.4 are potentially at risk. Successful exploitation can lead to unauthorized data modification, or system instability.

Recommendation

Upgrade goshs to version 2.0.0-beta.4 or later to remediate CVE-2026-40188 as mentioned in the overview.
Monitor SFTP logs for rename operations containing path traversal sequences like "../" in the destination path. (Generic Recommendation)
Implement file integrity monitoring (FIM) on critical system directories to detect unauthorized file modifications resulting from successful exploitation. (Generic Recommendation)