CVE-2026-42091: patrickhener goshs CSRF in PUT upload handler

CVE-2026-42091 · Severity: medium · CVSS 6.5 · Published 2026-05-04

goshs is a simple web server used for sharing files. A security flaw allows malicious websites to trick a user's browser into uploading or overwriting files on the server without the user's knowledge. This could allow an attacker to replace legitimate files with malicious ones or bypass network security controls if the server is running on a private internal network.

Technologies: github.com/patrickhener/goshs (Go), github.com/patrickhener/goshs/v2 (Go), goshs.de/goshs (Go), goshs.de/goshs/v2 (Go), Goshs. Vendors: Go, Goshs.

Quick answers

Is CVE-2026-42091 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42091 being exploited in the wild.
How severe is CVE-2026-42091?
Medium severity, with a CVSS score of 6.5, published 4 May 2026.
Which products and versions are affected?
github.com/patrickhener/goshs (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.4; github.com/patrickhener/goshs/v2 (Go) SEMVER:introduced=0,fixed=2.0.2; goshs.de/goshs (Go) SEMVER:introduced=0; goshs.de/goshs/v2 (Go) SEMVER:introduced=0,fixed=2.0.2.
Is there a fix for CVE-2026-42091?
Yes. github.com/patrickhener/goshs/v2 (Go): upgrade to 2.0.2 or later; goshs.de/goshs/v2 (Go): upgrade to 2.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42091 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42091?
Check whether you run github.com/patrickhener/goshs (Go), github.com/patrickhener/goshs/v2 (Go), goshs.de/goshs (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/patrickhener/goshs/v2 (Go): upgrade to 2.0.2 or later
    go get github.com/patrickhener/goshs/v2@v2.0.2
  • goshs.de/goshs/v2 (Go): upgrade to 2.0.2 or later
    go get goshs.de/goshs/v2@v2.0.2

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the PUT upload handler of goshs due to missing token validation in 'httpserver/updown.go'. This is exacerbated by a permissive Cross-Origin Resource Sharing (CORS) policy in 'httpserver/server.go' that uses a wildcard ('*') for 'Access-Control-Allow-Origin' during OPTIONS preflight requests. An attacker can leverage these flaws to perform cross-origin arbitrary file writes or overwrites. The attack requires a victim to visit a malicious website while the goshs instance is reachable from their browser (including localhost or internal network addresses). The issue is patched in version 2.0.2.

Affected products

  • patrickhener goshs <= 2.0.1

Identifiers

  • CVE-2026-42091
  • GHSA-rhf7-wvw3-vjvm
  • GO-2026-5625

Timeline

  • 2026-04-20: advisory: Vendor advisory published via GitHub
  • 2026-04-21: patched: Version 2.0.2 released
  • 2026-05-04: disclosed: CVE-2026-42091 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.