CVE-2026-40883

CVE-2026-40883 is a cross-site request forgery (CSRF) vulnerability affecting goshs versions 2.0.0-beta.4 through 2.0.0-beta.5, a SimpleHTTPServer implementation written in Go. The flaw exists in state-changing HTTP GET routes that lack proper CSRF protections, including missing Origin and Referer validation. An attacker can exploit this by tricking an already-authenticated user into triggering destructive actions such as file deletion or directory creation through malicious links or embedded requests. The vulnerability is exploitable via an external network vector with low complexity, as it requires only that a victim visit a malicious page while authenticated to the goshs instance. An authenticated browser session is the primary prerequisite, and the attack could result in unauthorized file system modifications including data loss or unauthorized directory creation. The FAUCET Risk Score of 34.0 out of 100 indicates moderate concern, though CVSS scoring is unavailable. This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and shows no active exploitation in the wild. The issue has been addressed in goshs version 2.0.0-beta.6, and the low EPSS score of 0.00019 suggests minimal real-world exploitation activity. The vulnerability remains inactive on security hotlists, indicating limited community attention or widespread deployment of affected versions.