GitHub Security Advisory: GHSA-wvhv-qcqf-f3cx
Package: github.com/patrickhener/goshs (GO)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-862: Missing Authorization
Vulnerable versions: <= 1.1.4
Patched in: unpatched

Summary: goshs has a file-based ACL authorization bypass in goshs state-changing routes

Details:
### Summary
goshs enforces the documented per-folder `.goshs` ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload files with `PUT`, upload files with multipart `POST /upload`, create directories with `?mkdir`, and delete files with `?delete` inside a `.goshs`-protected directory. By deleting the `.goshs` file itself, the attacker can remove the folder's auth policy and then access previously protected content without credentials. This results in a critical authorization bypass affecting confidentiality, integrity, and availability.

### Details
The project README explicitly documents file-based ACLs as a security feature:

- `README.md:59` - "You can place a .goshs in any folder to apply custom ACLs"
- `README.md:61` - "You can apply custom basic auth per folder"

The read/list path correctly enforces `.goshs`:

- `httpserver/filebased.go:10-49` loads `.goshs`
- `httpserver/handler.go:68-91` calls `findSpecialFile()` for directories
- `httpserver/handler.go:94-101` calls `findSpecialFile()` for files
- `httpserver/handler.go:285-305` applies custom auth
- `httpserver/handler.go:545-565` enforces folder auth during directory rendering
- `httpserver/handler.go:590-630` enforces file auth and blocked entries during file serving

However, the state-changing routes bypass this logic entirely:

- `httpserver/server.go:94-100` routes multipart `POST /.../upload` directly to `upload()`
- `httpserver/server.go:105-109` routes `PUT` directly to `put()`
- `httpserver/handler.go:119-123` dispatches `?mkdir` directly to `handleMkdir()`
- `httpserver/handler.go:181-187` dispatches `?delete` directly to `deleteFile()`
- `httpserver/updown.go:18-60` writes files for `PUT` without checking `.goshs`
- `httpserver/updown.go:63-165` writes files for multipart upload without checking `.goshs`
- `httpserver/handler.go:679-698` deletes files with `os.RemoveAll()` without checking `.goshs`
- `httpserver/handler.go:901-937` creates directories with `os.MkdirAll()` without checking `.goshs`

This is not a path traversal issue. The path remains inside the configured root after sanitization. The vulnerability is that authorization is applied inconsistently: reads are protected, but writes and deletes are not. Because `.goshs` itself can be deleted through the unauthenticated delete route, the attacker can escalate the impact from unauthorized modification to full removal of the folder's auth barrier.

### PoC
Environment used for verification:

- Repository/module: `github.com/patrickhener/goshs`
- Verified vulnerable tag: `v2.0.0-beta.3`
- Also present in the `v1.1.4` line based on code inspection
- Local host: `127.0.0.1:18091`

Build and setup:

```bash
cd '/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta3'
go build -o /tmp/goshs_acl_verify/goshs ./

rm -rf /tmp/goshs_acl_verify/root
mkdir -p /tmp/goshs_acl_verify/root/protected
cp in