CVE-2026-42091
Medium
Description
goshs is a SimpleHTTPServer written in Go. Prior to version 2.0.2, the PUT upload handler (httpserver/updown.go) lacks the CSRF token validation that was added to the POST upload handler during the CVE-2026-40883 fix. Combined with the unconditional Access-Control-Allow-Origin: * on the OPTIONS preflight handler (httpserver/server.go), any website can write arbitrary files to a goshs instance through the victim's browser — bypassing network isolation (e.g. localhost, internal network). This issue has been patched in version 2.0.2.
SeverityMedium
CVSS6.5
Exploit probability—
ProductGoshs
PublishedMay 4, 2026
First seenMay 4, 2026
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- goshs goshs2.0.2 or later
- github.com/patrickhener/goshs/v22.0.2 or later
- goshs.de/goshs/v22.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| goshs goshs | v < 2.0.2 | 2.0.2 |
| github.com/patrickhener/goshs/v2Go | v < 2.0.2 | 2.0.2 |
| github.com/patrickhener/goshsGo | v ≤ 1.1.4, No range specified | — |
| goshs.de/goshsGo | No range specified | — |
| goshs.de/goshs/v2Go | v < 2.0.2 | 2.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.