{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/goshs/v2--2.1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["goshs (\u003c= 1.1.4)","goshs/v2 (\u003c= 2.1.0)"],"_cs_severities":["high"],"_cs_tags":["authorization-bypass","webserver","vulnerability","cve","information-disclosure"],"_cs_type":"advisory","_cs_vendors":["patrickhener"],"content_html":"\u003cp\u003eA high-severity authorization bypass vulnerability, tracked as CVE-2026-54719, has been identified in \u003ccode\u003egoshs\u003c/code\u003e (versions \u0026lt;= 1.1.4) and \u003ccode\u003egoshs/v2\u003c/code\u003e (versions \u0026lt;= 2.1.0) which allows unauthenticated attackers to read arbitrary files. This flaw is a residual vulnerability from a previous fix (GHSA-wvhv-qcqf-f3cx) which addressed ACL bypasses on state-changing routes but failed to cover the \u003ccode\u003e?bulk\u003c/code\u003e zip-download endpoint. The \u003ccode\u003ebulkDownload\u003c/code\u003e function, invoked by requests containing \u003ccode\u003e?bulk\u003c/code\u003e and \u003ccode\u003e?file=\u003c/code\u003e parameters, retrieves file contents as a ZIP archive without performing the necessary \u003ccode\u003e.goshs\u003c/code\u003e ACL checks or honoring per-file block lists. This critical oversight enables any unauthenticated network attacker to bypass folder-level and file-level access controls, leading to unauthorized disclosure of confidential information from files located under the webroot. The vulnerability does not affect write or delete operations, limiting the impact to confidentiality only.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker identifies a vulnerable \u003ccode\u003egoshs\u003c/code\u003e instance exposed on the network.\u003c/li\u003e\n\u003cli\u003eThe attacker attempts to access a known protected file directly (e.g., \u003ccode\u003eGET /protected/secret.txt\u003c/code\u003e), which is correctly denied with a 401 Unauthorized response by the server's standard authorization flow.\u003c/li\u003e\n\u003cli\u003eThe attacker then crafts a malicious HTTP GET request targeting the \u003ccode\u003e?bulk\u003c/code\u003e zip-download route, appending the \u003ccode\u003e?file=\u003c/code\u003e parameter with the path to the desired protected file (e.g., \u003ccode\u003eGET /?bulk\u0026amp;file=/protected/secret.txt\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003egoshs\u003c/code\u003e server receives this request and routes it to the \u003ccode\u003ebulkDownload\u003c/code\u003e function, bypassing the normal authorization gates.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ebulkDownload\u003c/code\u003e function processes the \u003ccode\u003e?file=\u003c/code\u003e parameter, retrieves the content of \u003ccode\u003e/protected/secret.txt\u003c/code\u003e, and streams it back to the attacker within a ZIP archive.\u003c/li\u003e\n\u003cli\u003eThe attacker extracts the ZIP archive to obtain the contents of the confidential file, completely circumventing the \u003ccode\u003e.goshs\u003c/code\u003e ACL protections and any per-file block lists.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-54719 leads to unauthorized information disclosure, specifically the confidentiality of any file stored under the \u003ccode\u003egoshs\u003c/code\u003e webroot that relies solely on \u003ccode\u003e.goshs\u003c/code\u003e ACLs for protection. While a server-wide basic authentication mechanism (\u003ccode\u003e-b\u003c/code\u003e flag) would still gate the \u003ccode\u003e?bulk\u003c/code\u003e route, deployments relying on per-folder \u003ccode\u003e.goshs\u003c/code\u003e ACLs are vulnerable. Attackers can exfiltrate sensitive data such as configuration files, user data, or intellectual property without any authentication, posing a significant risk to data privacy and security. The vulnerability does not allow for data modification or deletion.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetects CVE-2026-54719 Exploitation - Goshs bulk download ACL bypass\u003c/code\u003e to your SIEM to identify attempts to exploit this vulnerability.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for \u003ccode\u003eGET\u003c/code\u003e requests to \u003ccode\u003e/?bulk\u003c/code\u003e containing the \u003ccode\u003efile=\u003c/code\u003e parameter, as these indicate potential exploitation attempts.\u003c/li\u003e\n\u003cli\u003eApply the latest security patches from \u003ccode\u003egoshs\u003c/code\u003e developers immediately, which should enforce \u003ccode\u003e.goshs\u003c/code\u003e ACLs within the \u003ccode\u003ebulkDownload\u003c/code\u003e function or route \u003ccode\u003e?bulk\u003c/code\u003e requests through the same authorization gate as normal read paths.\u003c/li\u003e\n\u003cli\u003eConduct an audit of other alternate read routes such as \u003ccode\u003e?cbDown\u003c/code\u003e within your \u003ccode\u003egoshs\u003c/code\u003e deployments for similar authorization bypass gaps.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T22:01:08Z","date_published":"2026-07-28T22:01:08Z","id":"https://feed.craftedsignal.io/briefs/2026-07-goshs-auth-bypass/","summary":"An unauthenticated attacker can exploit CVE-2026-54719 in goshs versions up to 1.1.4 and goshs/v2 up to 2.1.0 to bypass file-based Access Control Lists (ACLs) and read any file under the webroot using the `?bulk` zip-download route, leading to unauthorized information disclosure.","title":"Goshs File-Based ACL Authorization Bypass via Bulk Zip Download","url":"https://feed.craftedsignal.io/briefs/2026-07-goshs-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Goshs/V2 (\u003c= 2.1.0)","version":"https://jsonfeed.org/version/1.1"}