Skip to content
Threat Feed
Subscribe

Product

Goshs/V2 (<= 2.1.0)

1 brief RSS
high advisory

Goshs File-Based ACL Authorization Bypass via Bulk Zip Download

An unauthenticated attacker can exploit CVE-2026-54719 in goshs versions up to 1.1.4 and goshs/v2 up to 2.1.0 to bypass file-based Access Control Lists (ACLs) and read any file under the webroot using the `?bulk` zip-download route, leading to unauthorized information disclosure.

goshs +1 authorization-bypass webserver vulnerability cve information-disclosure
1r 3t