Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
goshs is a SimpleHTTPServer written in Go. Prior to version 2.0.2, the PUT upload handler (httpserver/updown.go) lacks the CSRF token validation that was added to the POST upload handler during the CVE-2026-40883 fix. Combined with the unconditional Access-Control-Allow-Origin: * on the OPTIONS preflight handler (httpserver/server.go), any website can write arbitrary files to a goshs instance through the victim's browser — bypassing network isolation (e.g. localhost, internal network). This issue has been patched in version 2.0.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-42091 Cross-Site Request Forgery in goshs SimpleHTTPServer Versions Below 2.0.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42091
Post summary
The post reports a CSRF vulnerability in goshs SimpleHTTPServer versions <2.0.2, presenting basic disclosure information without evidence of exploitation or patching.
CVE-2026-42091 goshs is a SimpleHTTPServer written in Go. Prior to version 2.0.2, the PUT upload handler (httpserver/updown.go) lacks the CSRF token validation that was added to the… https://www.cve.org/CVERecord?id=CVE-2026-42091
Post summary
The tweet announces CVE-2026-42091, describing a missing CSRF token check in goshs a Go-based HTTP server, providing the vulnerability details but no PoC, exploit, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | goshs | goshs | - | go | - |