CVE-2026-40883: falha de média gravidade em patrickhener goshs
goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.1%
goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because goshs relies on HTTP basic auth alone and performs no CSRF, Origin, or Referer validation for those routes. This vulnerability is fixed in 2.0.0-beta.6.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
patrickhener · goshsCVEs relacionadas — patrickhener goshs
No mesmo produto, das mais perigosas para as menos.
CVE-2025-46816CRITICALgoshs route not protected, allows command executionEPSS 0.7%CVE-2026-35471CRITICALImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshsEPSS 0.7%CVE-2026-35393CRITICALImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart uploadEPSS 0.7%CVE-2026-35392CRITICALgoshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT UploadEPSS 0.7%CVE-2026-40189CRITICALgoshs has a file-based ACL authorization bypass in goshs state-changing routesEPSS 0.6%CVE-2026-40884CRITICALgoshs: Empty-username SFTP password authentication bypass in goshsEPSS 0.5%