CVE-2026-40189: patrickhener goshs authorization bypass in state-changing routes

CVE-2026-40189 · Severity: critical · CVSS 9.8 · Published 2026-04-10

goshs, a tool for serving files over HTTP, contains a security flaw in its folder-level protection system. While it correctly asks for a password to view files, it fails to check for that password when an attacker tries to upload, create, or delete files. This allows an unauthenticated person to delete the security configuration file itself, effectively unlocking the folder and gaining full access to private data.

Technologies: github.com/patrickhener/goshs (Go). Vendors: Go.

Quick answers

Is CVE-2026-40189 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40189 being exploited in the wild.
How severe is CVE-2026-40189?
Critical severity, with a CVSS score of 9.8, published 10 April 2026.
Which products and versions are affected?
github.com/patrickhener/goshs (Go) <= 1.1.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.4.
Is there a fix for CVE-2026-40189?
A patch was published on 2026-04-10: v2.0.0-beta.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40189 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40189?
Check whether you run github.com/patrickhener/goshs (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability exists in goshs where state-changing HTTP handlers (upload, put, handleMkdir, and deleteFile) do not invoke the findSpecialFile() or custom auth logic used by read/list handlers. An unauthenticated remote attacker can use PUT or multipart POST requests to write files, or use the ?mkdir and ?delete query parameters to modify the filesystem. By deleting the .goshs ACL configuration file via the unauthenticated ?delete route, an attacker can permanently remove the authorization barrier for a directory, subsequently gaining access to previously protected files. The issue is present in versions up to 1.1.4 and v2.0.0-beta.3; it is addressed in v2.0.0-beta.4.

Affected products

  • patrickhener goshs <= 1.1.4, v2.0.0-beta.3

Identifiers

  • CVE-2026-40189
  • GHSA-wvhv-qcqf-f3cx
  • GO-2026-5728

Timeline

  • 2026-04-09: disclosed
  • 2026-04-10: advisory: GitHub Advisory published
  • 2026-04-10: patched: v2.0.0-beta.4 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.