CVE-2026-40883

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because goshs relies on HTTP basic auth alone and performs no CSRF, Origin, or Referer validation for those routes. This vulnerability is fixed in 2.0.0-beta.6.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/patrickhener/goshs/security/advisories/GHSA-jrq5-hg6x-j6g3	Exploit Vendor Advisory
https://github.com/patrickhener/goshs/security/advisories/GHSA-jrq5-hg6x-j6g3	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:goshs:goshs:2.0.0:beta4::::go::*
	cpe:2.3:a:goshs:goshs:2.0.0:beta5::::go::*

History

26 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) goshs es un SimpleHTTPServer escrito en Go. Desde la 2.0.0-beta.4 hasta la 2.0.0-beta.5, goshs contiene un problema de falsificación de petición en sitios cruzados en sus rutas HTTP GET que cambian de estado. Un atacante externo puede hacer que un navegador ya autenticado active acciones destructivas como ?delete y ?mkdir porque goshs se basa únicamente en la autenticación básica HTTP y no realiza validación de CSRF, Origin o Referer para esas rutas. Esta vulnerabilidad está corregida en la 2.0.0-beta.6.

Information

Published : 2026-04-21 20:17

Updated : 2026-10-26 00:10

NVD link : CVE-2026-40883

Mitre link : CVE-2026-40883

CVE.ORG link : CVE-2026-40883

JSON object : View

Products Affected

goshs

goshs

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2026-40883", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40883", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-21T20:16:59.493724Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "patrickhener", "product": "goshs", "versions": [{"status": "affected", "version": ">= 2.0.0-beta.4, < 2.0.0-beta.6"}]}]}], "published": "2026-04-21T20:17:01.983", "references": [{"url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-jrq5-hg6x-j6g3", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-jrq5-hg6x-j6g3", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because goshs relies on HTTP basic auth alone and performs no CSRF, Origin, or Referer validation for those routes. This vulnerability is fixed in 2.0.0-beta.6."}, {"lang": "es", "value": "goshs es un SimpleHTTPServer escrito en Go. Desde la 2.0.0-beta.4 hasta la 2.0.0-beta.5, goshs contiene un problema de falsificaci\u00f3n de petici\u00f3n en sitios cruzados en sus rutas HTTP GET que cambian de estado. Un atacante externo puede hacer que un navegador ya autenticado active acciones destructivas como ?delete y ?mkdir porque goshs se basa \u00fanicamente en la autenticaci\u00f3n b\u00e1sica HTTP y no realiza validaci\u00f3n de CSRF, Origin o Referer para esas rutas. Esta vulnerabilidad est\u00e1 corregida en la 2.0.0-beta.6."}], "lastModified": "2026-10-26T00:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:goshs:goshs:2.0.0:beta4:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "486D1F77-023B-4EB9-8B49-17EF6546F2DF"}, {"criteria": "cpe:2.3:a:goshs:goshs:2.0.0:beta5:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "5834E73F-2EF9-42BD-BE8B-DE087A19A132"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}