Executive brief
goshs is a simple web server used for sharing files. A security flaw allows malicious websites to trick a user's browser into uploading or overwriting files on the server without the user's knowledge. This could allow an attacker to replace legitimate files with malicious ones or bypass network security controls if the server is running on a private internal network.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the PUT upload handler of goshs due to missing token validation in 'httpserver/updown.go'. This is exacerbated by a permissive Cross-Origin Resource Sharing (CORS) policy in 'httpserver/server.go' that uses a wildcard ('*') for 'Access-Control-Allow-Origin' during OPTIONS preflight requests. An attacker can leverage these flaws to perform cross-origin arbitrary file writes or overwrites. The attack requires a victim to visit a malicious website while the goshs instance is reachable from their browser (including localhost or internal network addresses). The issue is patched in version 2.0.2.
Affected products
- patrickhener goshs <= 2.0.1
Timeline
- 2026-04-20: advisory: Vendor advisory published via GitHub
- 2026-04-21: patched: Version 2.0.2 released
- 2026-05-04: disclosed: CVE-2026-42091 published