# CVE-2026-42091: patrickhener goshs CSRF in PUT upload handler

Source: https://junglewise.ai/threats/cve-2026-42091-patrickhener-goshs-csrf-in-put-upload-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-04. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-42091 · Severity: medium · CVSS 6.5 · Published 2026-05-04

goshs is a simple web server used for sharing files. A security flaw allows malicious websites to trick a user's browser into uploading or overwriting files on the server without the user's knowledge. This could allow an attacker to replace legitimate files with malicious ones or bypass network security controls if the server is running on a private internal network.

Technologies: [github.com/patrickhener/goshs (Go)](https://junglewise.ai/threats/technologies/github-com-patrickhener-goshs), [github.com/patrickhener/goshs/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-patrickhener-goshs-v2), [goshs.de/goshs (Go)](https://junglewise.ai/threats/technologies/goshs-de-goshs), [goshs.de/goshs/v2 (Go)](https://junglewise.ai/threats/technologies/goshs-de-goshs-v2), [Goshs](https://junglewise.ai/threats/technologies/goshs). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Goshs](https://junglewise.ai/threats/vendors/goshs).

## Quick answers

**Is CVE-2026-42091 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42091 being exploited in the wild.

**How severe is CVE-2026-42091?** Medium severity, with a CVSS score of 6.5, published 4 May 2026.

**Which products and versions are affected?** github.com/patrickhener/goshs (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.4; github.com/patrickhener/goshs/v2 (Go) SEMVER:introduced=0,fixed=2.0.2; goshs.de/goshs (Go) SEMVER:introduced=0; goshs.de/goshs/v2 (Go) SEMVER:introduced=0,fixed=2.0.2.

**Is there a fix for CVE-2026-42091?** Yes. github.com/patrickhener/goshs/v2 (Go): upgrade to 2.0.2 or later; goshs.de/goshs/v2 (Go): upgrade to 2.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42091 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42091?** Check whether you run github.com/patrickhener/goshs (Go), github.com/patrickhener/goshs/v2 (Go), goshs.de/goshs (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/patrickhener/goshs/v2 (Go): upgrade to 2.0.2 or later

  ```sh
  go get github.com/patrickhener/goshs/v2@v2.0.2
  ```

- goshs.de/goshs/v2 (Go): upgrade to 2.0.2 or later

  ```sh
  go get goshs.de/goshs/v2@v2.0.2
  ```


## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the PUT upload handler of goshs due to missing token validation in 'httpserver/updown.go'. This is exacerbated by a permissive Cross-Origin Resource Sharing (CORS) policy in 'httpserver/server.go' that uses a wildcard ('*') for 'Access-Control-Allow-Origin' during OPTIONS preflight requests. An attacker can leverage these flaws to perform cross-origin arbitrary file writes or overwrites. The attack requires a victim to visit a malicious website while the goshs instance is reachable from their browser (including localhost or internal network addresses). The issue is patched in version 2.0.2.

## Affected products

- patrickhener goshs <= 2.0.1

## Identifiers

- CVE-2026-42091
- GHSA-rhf7-wvw3-vjvm
- GO-2026-5625

## Timeline

- 2026-04-20: advisory: Vendor advisory published via GitHub
- 2026-04-21: patched: Version 2.0.2 released
- 2026-05-04: disclosed: CVE-2026-42091 published

## References

- [https://github.com/patrickhener/goshs/commit/0e715b94e10c3d1aa552276000f15f104dee2f32](https://github.com/patrickhener/goshs/commit/0e715b94e10c3d1aa552276000f15f104dee2f32)
- [https://github.com/patrickhener/goshs/releases/tag/v2.0.2](https://github.com/patrickhener/goshs/releases/tag/v2.0.2)
- [https://github.com/patrickhener/goshs/security/advisories/GHSA-rhf7-wvw3-vjvm](https://github.com/patrickhener/goshs/security/advisories/GHSA-rhf7-wvw3-vjvm)

## Related threats

- [patrickhener goshs race condition in share-link download limit](https://junglewise.ai/threats/cve-2026-50139-patrickhener-goshs-race-condition-in-share-link-download-limit)
- [patrickhener goshs access control bypass in WebDAV listener](https://junglewise.ai/threats/cve-2026-50138-patrickhener-goshs-access-control-bypass-in-webdav-listener)
- [goshs-labs goshs ACL bypass via trailing slash in sendFile handler](https://junglewise.ai/threats/cve-2026-66064-goshs-labs-goshs-acl-bypass-via-trailing-slash-in-sendfile)
- [goshs path traversal in multipart upload handler](https://junglewise.ai/threats/cve-2026-66063-goshs-path-traversal-in-multipart-upload-handler)
- [goshs WebDAV deletion bypass via MOVE and COPY methods](https://junglewise.ai/threats/cve-2026-64863-goshs-webdav-deletion-bypass-via-move-and-copy-methods)