# goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)

goshs ?bulk zip-download route skips .goshs ACL checks, letting unauthenticated attackers read folder-protected and block-listed files under the webroot.

- Payout: Research
- Severity: high
- Program: goshs
- Found by: anir0y
- Disclosed: 2026-07-28
- CVE: CVE-2026-54719
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-rmxw-pq4x-3fvh
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-rmxw-pq4x-3fvh
- Tags: area:web domain:web impact:data-leak kind:research platform:ghsa sev:high tech:go technique:incomplete-fix technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** HTTP file server ?bulk zip-download endpoint
**Root cause:** bulkDownload in httpserver/updown.go is dispatched from earlyBreakParameters before the normal doDir/doFile/sendFile flow and never calls findEffectiveACL/applyCustomAuth, so per-folder .goshs ACLs and block lists are not enforced on the zip route.
**Steps:**
1. Serve goshs v2.1.0 with no global -b auth, only a per-folder .goshs ACL in /protected.
2. Confirm normal path enforces ACL: `GET /protected/secret.txt` -> 401; with `-u admin:admin` -> 200.
3. Request `GET /?bulk&file=/protected/secret.txt` -> 200, ZIP contains protected file contents.
4. Request `GET /?bulk&file=/protected/blocked.txt` -> 200, ZIP contains block-listed file.
**How found:** Reporter revisited the prior advisory GHSA-wvhv-qcqf-f3cx, which claimed the read/list path correctly enforced .goshs, and tested alternate read routes; found ?bulk dispatched via earlyBreakParameters ahead of the ACL-checking sendFile/processDir flow.
**Exploitation:** Unauthenticated attacker sends a single GET to /?bulk with one or more ?file= parameters pointing at ACL-protected paths under the webroot; bulkDownload sanitizes the path but streams the file into a ZIP response without any authorization check, disclosing contents.
**Insight:** When a fix adds authorization to the main request handler, enumerate every alternate dispatch path (early-return parameter handlers, bulk/zip/export/download endpoints) that reaches the filesystem before the gate; here earlyBreakParameters short-circuits the ACL check.

## Proof of concept (copied exactly from the original report)

**Bulk zip-download bypasses .goshs ACL**

```
GET /protected/secret.txt              -> 401 (ACL enforced on normal path)
  GET /protected/secret.txt -u admin:admin -> 200
  GET /?bulk&file=/protected/secret.txt  -> 200, zip contains the protected file contents  (BYPASS)
  GET /?bulk&file=/protected/blocked.txt -> 200, zip contains the block-listed file        (block bypass)
  GET /protected/secret.txt?share        -> 403 'Sharing disabled when auth is disabled'
```