The vulnerability exists in goshs’s HTTP file handler, which opens files using a cleaned path but authenticates access against the raw request URL path. By sending a request that ends with a trailing slash, an attacker can bypass the .goshs ACL-file protection and block-list checks, allowing the server to serve files that should otherwise be denied. This results in unauthorized file disclosure beyond the intended directory. The weakness maps to CWE‑41 Path Traversal and CWE‑863 Broken Access Control.

The affected product is goshs from goshs‑labs. Any installation running a version earlier than 2.1.5 is vulnerable; the issue is resolved in release 2.1.5 and later.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at the current time. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an unauthenticated HTTP request to the server’s port, where an attacker can freely construct a request with a trailing slash to read files beyond the intended directory. Based on the description, it is inferred that no authentication or privileged conditions are required, making the attack straightforward for anyone who can reach the service over the network.