# CVE-2026-40903: goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED…

Source: https://junglewise.ai/threats/cve-2026-40903-goshs-is-a-simplehttpserver-written-in-go-prior-to-2-0-0-beta-6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-21  
License: CC BY 4.0 with a link back

CVE-2026-40903 · Severity: critical · CVSS 9.1 · Published 2026-04-21

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.

Technologies: [Goshs](https://junglewise.ai/threats/technologies/goshs). Vendors: [Goshs](https://junglewise.ai/threats/vendors/goshs).

## Quick answers

**Is CVE-2026-40903 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40903 being exploited in the wild.

**How severe is CVE-2026-40903?** Critical severity, with a CVSS score of 9.1, published 21 April 2026.

**Which products and versions are affected?** Goshs. The advisory does not name versions.

**Is there a fix for CVE-2026-40903?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-40903?** Check whether you run Goshs. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Goshs

## Related threats

- [patrickhener goshs CSRF in PUT upload handler](https://junglewise.ai/threats/cve-2026-42091-patrickhener-goshs-csrf-in-put-upload-handler)
- [goshs's public collaborator feed leaks .goshs ACL credentials and enables unauthorized access](https://junglewise.ai/threats/cve-2026-40885-goshs-s-public-collaborator-feed-leaks-goshs-acl-credentials-and)
- [goshs has an empty-username SFTP password authentication bypass](https://junglewise.ai/threats/cve-2026-40884-goshs-has-an-empty-username-sftp-password-authentication-bypass)
- [goshs has CSRF in state-changing GET routes enables authenticated file deletion and directory creation](https://junglewise.ai/threats/cve-2026-40883-goshs-has-csrf-in-state-changing-get-routes-enables-authenticated)
- [goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP root escape caused by prefix-based path validation.](https://junglewise.ai/threats/cve-2026-40876-sftp-root-escape-via-prefix-based-path-validation-in-goshs)