Read the docs
TI-2026-29539 Aliases CVE-2026-40883GHSA-jrq5-hg6x-j6g3

goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation

Priority MEDIUM 60CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Tampering
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because goshs relies on HTTP basic auth alone and performs no CSRF, Origin, or Referer validation for those routes. This vulnerability is fixed in 2.0.0-beta.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00143 3rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed goshs (patrickhener): 2.0.0-beta.6github.com/patrickhener/goshs/v2 (Go): 2.0.0-beta.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
patrickhenergoshs2.0.0-beta.4 to before 2.0.0-beta.62.0.0-beta.6Patch availableCNA
—github.com/patrickhener/goshs/v2 (Go)2.0.0-beta.4 to before 2.0.0-beta.62.0.0-beta.6Patch availableGHSA-jrq5-hg6x-j6g3
  • goshs Vendorpatrickhener Affected 2.0.0-beta.4 to before 2.0.0-beta.6 Fixed in 2.0.0-beta.6 Patch available CNA
  • github.com/patrickhener/goshs/v2 (Go) Vendor— Affected 2.0.0-beta.4 to before 2.0.0-beta.6 Fixed in 2.0.0-beta.6 Patch available GHSA-jrq5-hg6x-j6g3

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:goshs:goshs:2.0.0:beta4:*:*:*:go:*:*2.0.0 beta4Vulnerablepatrickhener
cpe:2.3:a:goshs:goshs:2.0.0:beta5:*:*:*:go:*:*2.0.0 beta5Vulnerablepatrickhener
  • cpe:2.3:a:goshs:goshs:2.0.0:beta4:*:*:*:go:*:* Versions 2.0.0 beta4 Vulnerable ·patrickhener
  • cpe:2.3:a:goshs:goshs:2.0.0:beta5:*:*:*:go:*:* Versions 2.0.0 beta5 Vulnerable ·patrickhener

Remediation

  • Fix · CNA goshs (patrickhener) Fixed in 2.0.0-beta.6
  • Fix · GHSA-jrq5-hg6x-j6g3 github.com/patrickhener/goshs/v2 (Go) Fixed in 2.0.0-beta.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40883
  2. 2026-10-03 Alias added: GHSA-jrq5-hg6x-j6g3

References

Exploit 1

Advisory 1

Other 1

  • TI-2026-29540 goshs: Empty-username SFTP password authentication bypass in goshs CVSS 3.1CRITICAL 9.8
  • TI-2026-27601 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs CVSS 3.0CRITICAL 9.8
  • TI-2026-27529 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload CVSS 3.0CRITICAL 9.8
  • TI-2026-27528 goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload CVSS 3.0CRITICAL 9.8
  • TI-2026-29003 goshs has a file-based ACL authorization bypass in goshs state-changing routes CVSS 4.0CRITICAL 9.3
  • TI-2026-29532 SFTP root escape via prefix-based path validation in goshs CVSS 4.0HIGH 8.7
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences