GHSA-964w-f6gj-5236: goshs has ACL Bypass & Path Traversal

goshs (a file server) has a security flaw where appending a trailing slash to a file request bypasses access controls. The bug occurs because the code checks file permissions using the raw request path, but opens files using a cleaned path, and a trailing slash causes the permission check to use an empty filename. This allows attackers to read blocked files and even the ACL configuration file (which contains password hashes) without authentication.