An attacker can bypass directory protection by exploiting a flaw in the authorization checks applied to state‑changing routes in goshs. The server accepts PUT, multipart POST /upload, ?mkdir, and ?delete requests even from unauthenticated clients, allowing creation, modification, or deletion of files. Deleting the ".goshs" ACL file removes the protected‑directory policy, granting full access to previously restricted content. This flaw results in a hard‑coded authorization bypass that can compromise confidentiality, integrity, and availability, and is classified under CWE‑862.

Versions of goshs up to (but not including) 2.0.0‑beta.4 are affected. The vulnerability exists in the 2.0.0‑beta.1, beta.2, and beta.3 releases as well as any earlier build that did not implement the state‑changing route check. The product is the Go‑based SimpleHTTPServer known as goshs, maintained by the patrickhener project.

The CVSS base score of 9.3 reflects a high‑severity vulnerability. While the EPSS score is below 1 %, indicating low current exploitation probability, the flaw is publicly documented and no mitigation exists other than updating. Because the attack path requires only unauthenticated HTTP requests to a reachable server, the risk to environments running vulnerable releases is substantial. Deployment of affected versions without proper firewalls or authentication proxies creates a straightforward surface for attackers to gain unauthorized file access or alter server state.