CVE-2026-40189

OVERVIEW CVE-2026-40189 is a critical authorization bypass vulnerability in goshs, a Go-based SimpleHTTPServer implementation. The flaw exists in versions prior to 2.0.0-beta.4 and allows unauthenticated attackers to circumvent access controls on protected directories by exploiting missing authorization checks on state-changing operations. SEVERITY The vulnerability carries a CVSS 3.1 score of 9.8 (CRITICAL) with a network attack vector requiring no authentication, low complexity, and no user interaction. An attacker can upload files via PUT or multipart POST requests, create directories, delete files, and critically, delete the .goshs configuration file itself to remove authentication protections entirely. This results in complete compromise of confidentiality, integrity, and availability for protected content. EXPLOITATION STATUS The vulnerability is currently inactive on vulnerability tracking lists with no evidence of active exploitation in the wild. The EPSS score of 0.00139 is significantly lower than the average CVE, suggesting minimal exploitation likelihood in practice. No public exploit code has achieved widespread attention, and the issue appears to have limited community exploitation activity at this time.