Cloudanix VulnDB

GHSA-rhf7-wvw3-vjvm

Medium · 6.5

goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS

CVSS

6.5

EPSS

—

Published

Apr 23, 2026

CISA due date

—

The record

The PUT upload handler (`httpserver/updown.go`) lacks the CSRF token validation that was added to the POST upload handler during the GHSA-jrq5-hg6x-j6g3 fix. Combined with the unconditional `Access-Control-Allow-Origin: *` on the OPTIONS preflight handler (`httpserver/server.go`), any website can write arbitrary files to a goshs instance through the victim's browser — bypassing network isolation (e.g. localhost, internal network).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities