VDB
Sign up
—

GO-2026-6133

goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

Quick fix

GO-2026-6133 — goshs.de/goshs/v2: upgrade to the fixed version with the command below.

go get goshs.de/goshs/v2@v2.1.1

Details

goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx) in github.com/patrickhener/goshs

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/patrickhener/goshs
Introduced in: 0

No fixed version published yet for github.com/patrickhener/goshs (go modules). Pin to a known-safe version or switch to an alternative.

Go/goshs.de/goshs
Introduced in: 0

No fixed version published yet for goshs.de/goshs (go modules). Pin to a known-safe version or switch to an alternative.

Go/goshs.de/goshs/v2
Introduced in: 0Fixed in: 2.1.1
Fixgo get goshs.de/goshs/v2@v2.1.1

References