Cloudanix VulnDB

GHSA-7qx6-f23w-3w7f

None · 0.0

Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint

CVSS

0.0

EPSS

—

Published

Apr 14, 2026

CISA due date

—

The record

The `GET /?redirect` endpoint in `goshs` v2.0.0-beta.6 performs an HTTP redirect to any attacker-supplied `url=` value and writes any attacker-supplied `header=Name: Value` pair into the response, without scheme/host validation, without a header-name allow-list, without authentication in the default deployment, and without the `checkCSRF()` guard that GHSA-jrq5-hg6x-j6g3 added to the other state-changing GET routes (`?mkdir`, `?delete`). The same dispatcher also lacks an `fs.Invisible` branch, so the endpoint stays responsive in `-I` stealth mode and reliably fingerprints an "invisible" goshs deployment with a single request.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities