CVE-2026-40883 Details
Description
goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because goshs relies on HTTP basic auth alone and performs no CSRF, Origin, or Referer validation for those routes. This vulnerability is fixed in 2.0.0-beta.6.
A cross-site request forgery (CSRF) vulnerability has been identified in goshs versions 2.0.0-beta.4 prior to 2.0.0-beta.5. This issue allows external attackers to exploit state-changing HTTP GET routes, causing authenticated users' browsers to perform destructive actions such as file deletion and directory creation. The vulnerability arises because goshs relies solely on HTTP basic authentication for validation and does not implement CSRF protections or validate the Origin or Referer headers for these routes. The vulnerability has been patched in version 2.0.0-beta.6.
Users are advised to update to goshs version 2.0.0-beta.6 or later. Additionally, it is recommended to move state-changing actions off GET routes and implement CSRF protections, such as per-request tokens and strict validation of Origin and Referer headers.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/patrickhener/goshs/security/advisories/GHSA-jrq5-hg6x-j6g3 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/patrickhener/goshs/security/advisories/GHSA-jrq5-hg6x-j6g3 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| goshs goshs | 2.0.0 beta4 2.0.0 beta5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 21, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | New CVE Received | [email protected] |