CVE-2026-40883 goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation
An attacker can trick an authenticated user into deleting files or creating directories via CSRF in goshs HTTP server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-40883?
CVE-2026-40883 is a medium-severity vulnerability in patrickhener goshs, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because goshs relies on HTTP basic auth alone and performs no CSRF, Origin, or Referer validation for those routes. This vulnerability is fixed in 2.0.0-beta.6.
Weakness: CWE-352
Which versions are affected by CVE-2026-40883?
4 open source packages ship an affected version, including github.com/patrickhener/goshs/v2 and github.com/patrickhener/goshs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/patrickhener/goshs/v2 Go | From 2.0.0-beta.4 | 2.0.0-beta.6 |
github.com/patrickhener/goshs/v2 Go | From 2.0.0-beta.4 | 2.0.0-beta.6 |
github.com/patrickhener/goshs/v2 Go | From 2.0.0-beta.4 | 2.0.0-beta.6 |
github.com/patrickhener/goshs Go | All versions | None |
Products include Goshs Goshs.
How do I fix CVE-2026-40883?
Upgrade github.com/patrickhener/goshs/v2 to 2.0.0-beta.6 or later.
Is CVE-2026-40883 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40883 exists.
Other vulnerabilities in patrickhener goshs
- CVE-2026-40884 goshs: Empty-username SFTP password authentication bypass in goshs
- CVE-2026-35392 goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload
- CVE-2026-35393 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload
- CVE-2026-35471 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs
- CVE-2026-40189 goshs has a file-based ACL authorization bypass in goshs state-changing routes
Sources
Also known as GHSA-jrq5-hg6x-j6g3, GO-2026-5479.