What is CVE-2026-54719?

CVE-2026-54719 is a high-severity vulnerability in Goshs-Labs Goshs, classified under Missing Authorization. CVSS score: 7.5/10. Published 2026-07-28.

How severe is CVE-2026-54719?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Goshs-Labs Goshs

CVE-2026-54719

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189.

Vulnerability class: Broken Access Control

EPSS: 0.003 (20.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Goshs-labs Goshs — versions < 2.1.1

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-54719?: CVE-2026-54719 is a high-severity vulnerability in Goshs-Labs Goshs, classified under Missing Authorization. CVSS score: 7.5/10. Published 2026-07-28.
How severe is CVE-2026-54719?: High severity. CVSS v3 base score is 7.5 out of 10.