goshs is a single‑binary file server that, before version 2.1.1, allowed anyone to download archived files via the ?bulk &file= route without enforcing ACL checks. This bypass lets attackers read files that are otherwise protected only by .goshs folder ACLs or block lists. The vulnerability stems from an incomplete fix of an earlier flaw. Because the bypass removes authentication checks, the primary impact is a confidentiality breach – an unauthenticated reader can obtain any file that resides in the server’s file system and is subject to the ACL mechanism.

Vendors and products affected are goshs‑labs’ goshs single‑binary file server. All releases prior to v2.1.1 are vulnerable, including all 2.0.x and earlier releases.

The CVSS score of 7.5 classifies this as a high‑severity information‑disclosure flaw. The EPSS score is below 1 %, indicating a very low probability of exploitation at present. The vulnerability is listed in the CISA KEV catalog as not listed. Attackers can simply issue an unauthenticated HTTP GET to the bulk download endpoint to retrieve ZIP archives of protected files. No additional privileges or credentials are required, making the attack straightforward once the vulnerable version is running.