VulnSocial

CVE-2026-54719Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomplete fix for CVE-2026-40189.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 2 classified signals
  • Peaked 1d ago at 3 mentions (2026-07-29); latest day: 1
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-07-29: 3Mentions · 2026-07-30: 1Technical Details · 2026-07-29: 2Technical Details · 2026-07-30: 107-2907-30
Signal classification2 categories
Disclosure
250.0%
General
250.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-293
Disclosure1General2
2026-07-301
Disclosure1
Full discourse4 posts
  • Israel@f1tym1
    Disclosure

    CVE-2026-54719: Missing Authorization in goshs-labs goshs https://ift.tt/TwyjVka

    Post summary

    The text introduces CVE-2026-54719, describing an authorization bypass issue in the goshs project by goshs-labs, but provides limited details beyond the vulnerability type.

    0000035
    1.0K followersView on X
  • Israel@f1tym1
    General

    CVE-2026-54719: Missing Authorization in goshs-labs goshs https://ift.tt/TwyjVka

    Post summary

    The post announces a missing authorization flaw in goshs‑labs goshs, offering only a brief description without further technical or actionable details.

    0000038
    1.0K followersView on X
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-54719 goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP do… https://www.cve.org/CVERecord?id=CVE-2026-54719 ----- Traducción: CVE-2026-54719 gos… http://infoflow.cloud`

    Post summary

    The post identifies CVE-2026-54719 as related to a vulnerability in the goshs file server’s bulkDownload handler before version 2.1.1, but lacks detailed technical, exploit, or mitigation information.

    0000037
    96 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-54719 goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP do… https://www.cve.org/CVERecord?id=CVE-2026-54719

    Post summary

    CVE‑2026‑54719 highlights a vulnerability in goshs’s bulkDownload handler before v2.1.1; no PoC, exploit, or patch is discussed in the text.

    00000759
    57.9K followersView on X

Explore more

Back to dashboard