CVE-2026-42091 goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS
Attackers can write arbitrary files to goshs instances via CSRF and wildcard CORS, bypassing network isolation to modify data or execute code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-42091?
CVE-2026-42091 is a medium-severity vulnerability in patrickhener goshs, published on 4 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
goshs is a SimpleHTTPServer written in Go. Prior to version 2.0.2, the PUT upload handler (httpserver/updown.go) lacks the CSRF token validation that was added to the POST upload handler during the CVE-2026-40883 fix. Combined with the unconditional Access-Control-Allow-Origin: * on the OPTIONS preflight handler (httpserver/server.go), any website can write arbitrary files to a goshs instance through the victim's browser — bypassing network isolation (e.g. localhost, internal network). This issue has been patched in version 2.0.2.
Weakness: CWE-352
Which versions are affected by CVE-2026-42091?
7 open source packages ship an affected version, including github.com/patrickhener/goshs, github.com/patrickhener/goshs/v2 and goshs.de/goshs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/patrickhener/goshs Go | All versions | None |
github.com/patrickhener/goshs Go | All versions to 1.1.4 | None |
github.com/patrickhener/goshs Go | All versions to 1.1.4 | None |
github.com/patrickhener/goshs/v2 Go | All versions | 2.0.2 |
github.com/patrickhener/goshs/v2 Go | All versions | 2.0.2 |
goshs.de/goshs Go | All versions | None |
1 more packages
goshs.de/goshs/v2 Go | All versions | 2.0.2 |
Products include Goshs Goshs.
How do I fix CVE-2026-42091?
Upgrade to a fixed version.
Is CVE-2026-42091 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42091 exists.
Other vulnerabilities in patrickhener goshs
- CVE-2026-40884 goshs: Empty-username SFTP password authentication bypass in goshs
- CVE-2026-35392 goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload
- CVE-2026-35393 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload
- CVE-2026-35471 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs
- CVE-2026-40189 goshs has a file-based ACL authorization bypass in goshs state-changing routes
Sources
Also known as GHSA-rhf7-wvw3-vjvm, GO-2026-5625.