CVE-2026-40883

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because...

CVE-2026-40883

creationtimestamp| type| source ---|---|--- 2026-04-13 08:15:48+00:00| published-proof-of-concept| https://github.com/patrickhener/goshs/security/advisories/GHSA-jrq5-hg6x-j6g3...