CVE-2026-40189 Details

A critical authorization bypass vulnerability has been identified in goshs, a SimpleHTTPServer written in Go. This issue affects versions through 2.0.0-beta.3. The vulnerability arises because goshs enforces its per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but not for state-changing operations such as file uploads, directory creation, and file deletions. As a result, an unauthenticated attacker can exploit this oversight to manipulate files and directories within .goshs-protected areas. The attacker can upload files via PUT or multipart POST requests, create directories using the ?mkdir parameter, and delete files, including the .goshs file itself, thereby removing the folder's authentication policy and accessing previously protected content without credentials. This vulnerability undermines the confidentiality, integrity, and availability of the affected system.

Update to goshs version 2.0.0-beta.4 or later, where this vulnerability has been fixed. In the updated version, .goshs authorization checks are enforced for all state-changing operations, and the .goshs file is protected in mutation handlers.