Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_M

CVE-2026-40883goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation

Medium 6.1

In plain English

A medium-severity cross-site request forgery in goshs from patrickhener. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.1Medium

Exploit odds (30 days)0.1%top 96.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because goshs relies on HTTP basic auth alone and performs no CSRF, Origin, or Referer validation for those routes. This vulnerability is fixed in 2.0.0-beta.6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/patrickhener/goshs	no fix listed	GO-2026-5479
Go	github.com/patrickhener/goshs/v2	2.0.0-beta.6	GHSA-jrq5-hg6x-j6g3
Go	github.com/patrickhener/goshs/v2	2.0.0-beta.6	GO-2026-5479

Affected products (as reported)

Vendor	Product	Versions
patrickhener	goshs	>= 2.0.0-beta.4, < 2.0.0-beta.6

Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/patrickhener/goshs/security/advisories/GHSA-jrq5-hg6x-j6g3 x_refsource_CONFIRM