CVE-2026-40883

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40883
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40883.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40883
Aliases
Downstream
Related
Published
2026-04-21T19:35:37.652Z
Modified
2026-07-31T18:30:36.603611009Z
Severity
  • 6.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation
Details

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because goshs relies on HTTP basic auth alone and performs no CSRF, Origin, or Referer validation for those routes. This vulnerability is fixed in 2.0.0-beta.6.

Database specific 
{
    "cwe_ids": [
        "CWE-352"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40883.json"
}
References

Affected packages

Git / github.com/goshs-labs/goshs

Affected ranges

Type
GIT
Repo
https://github.com/goshs-labs/goshs
Events
Introduced
10f291dea17fb795f0008ed64c3ad7ab8c0470de
Fixed
2f6b5d601d494601fa43fad9a712ee6117b7dbcd
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "2.0.0-beta.4"
        },
        {
            "fixed": "2.0.0-beta.6"
        }
    ]
}

Affected versions

v2.*
v2.0.0-beta.4
v2.0.0-beta.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40883.json"