goshs CVE-2026-50139

Exploitation requires three concrete conditions: (1) the goshs instance has the share-link feature in use and at least one token has been issued with a non-zero DownloadLimit - tokens with no limit (DownloadLimit == -1) are unaffected by this race since the bypass is only meaningful when a cap is intended; (2) the attacker possesses a valid, unexpired share token - this is the primary prerequisite and is not granted by this vulnerability itself; (3) the attacker can dispatch two or more concurrent HTTP requests within the file-transfer window, which widens naturally with larger files. No authentication to the goshs server is required once the token is known (PR:N per CVSS), and no special client tooling beyond standard HTTP is needed. What limits exploitation: the attacker must have obtained the token through a prior disclosure channel; goshs is typically deployed on local or trusted networks, reducing the default exposure surface; the race window, while practically exploitable, does introduce a timing dependency (AC:H per CVSS) that could fail under high-latency or rate-limited network paths.

The vendor-assigned CVSS 3.1 score of 5.9 Medium (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) is consistent with the technical facts. AC:H reflects that successful exploitation requires concurrent HTTP requests timed within the same TOCTOU window; however, the included POC demonstrates 5/5 reliable reproduction with only two parallel curl processes, suggesting the race window is wide enough to be readily won in practice - AC:H may overstate the real-world difficulty. The vulnerability is not in CISA KEV, indicating no confirmed widespread active exploitation at the time of analysis. EPSS data is not present in the provided intelligence and cannot be estimated here. The primary gating factor for real-world risk is token possession: an attacker must first obtain a valid, unexpired share token before the race is meaningful. For operators using goshs to distribute one-shot secrets (credentials, signing keys, sensitive documents) under the assumption that limit=1 provides a hard delivery guarantee, this race condition represents a significant control failure - the intended single-use property is entirely defeated. Risk is further bounded by goshs's typical deployment profile as a personal or small-team tool rather than a large-scale enterprise service.

An attacker who obtains a valid goshs share token - through email interception, browser history exposure, or a forwarded link - issues two or more simultaneous HTTP GET requests to /?token=<token> using parallel HTTP clients (e.g., background curl processes). All requests enter the TOCTOU window simultaneously, each independently reads Downloaded < DownloadLimit as true before any increment is committed, and each receives a 200 response with the full file. The publicly available POC in GHSA-j48m-h7xq-2xpj demonstrates this with two concurrent requests against a limit=1 token, achieving two successful redemptions on five consecutive attempts.