PT-2026-36883 · Goshs · Goshs

Patrickhener · Published 2026-04-23 · Updated 2026-05-12 · CVE-2026-42091

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.0.2

Description The PUT upload handler in httpserver/updown.go lacks Cross-Site Request Forgery (CSRF) token validation. CSRF is a type of attack that tricks a victim into submitting a malicious request. This deficiency, combined with the unconditional Access-Control-Allow-Origin: * header on the OPTIONS preflight handler in httpserver/server.go, allows any website to write arbitrary files to a goshs instance via a victim's browser, effectively bypassing network isolation such as localhost or internal networks.

Recommendations Update to version 2.0.2.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-42091

GHSA-RHF7-WVW3-VJVM

Affected Products

Goshs

References · 10

• 🔥 https://github.com/patrickhener/goshs/security/advisories/GHSA-rhf7-wvw3-vjvm · Exploit
• https://github.com/patrickhener/goshs/commit/0e715b94e10c3d1aa552276000f15f104dee2f32 · Patch
• https://osv.dev/vulnerability/GHSA-rhf7-wvw3-vjvm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42091 · Security Note
• https://github.com/patrickhener/goshs · Note
• https://github.com/patrickhener/goshs/releases/tag/v2.0.2 · Note
• https://twitter.com/CVEnew/status/2051361260579479698 · Twitter Post
• https://t.me/CVEtracker/52651 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2051388293221081288 · Twitter Post
• https://t.me/cveNotify/163264 · Telegram Post