CVE-2026-54719 goshs-labs CVE debrief

Who should care

Defenders managing goshs servers, especially those exposed to untrusted networks or with publicly accessible bulk download features, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-54719 allows unauthenticated reads of files protected by .goshs folder ACLs and block lists in goshs versions prior to 2.1.1. Defenders managing exposed goshs servers should prioritize verification and remediation.

• Verify exposure of goshs servers to untrusted networks.
• Assess potential for unauthorized file reads.
• Prioritize remediation of affected servers.
• Verify proper configuration of .goshs folder ACLs and block lists.

Technical summary

The bulkDownload handler in goshs versions prior to 2.1.1 did not properly apply authentication or ACL checks, allowing unauthenticated reads of protected files. This issue arises from an incomplete fix for CVE-2026-40189, where the fix did not fully address the vulnerability in the httpserver/updown.go file. The vulnerability allows attackers to read files protected by .goshs folder ACLs and block lists without proper authorization. The fix in version 2.1.1 addresses this issue by correctly implementing authentication and ACL checks in the bulkDownload handler.

Defensive priority

Defenders should prioritize verifying exposure of goshs servers, especially those with publicly accessible bulk download features, and ensure they are running version 2.1.1 or later.

Recommended defensive actions

• Verify goshs server versions and ensure 2.1.1 or later is deployed.
• Review .goshs folder ACLs and block lists for proper configuration.
• Monitor for unusual bulk download activity.
• Perform vulnerability scanning to identify exposed goshs servers.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix in version 2.1.1. However, additional information on affected deployments and potential exploitation is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.