Skip to content
OpenAdvisories

Vendor

patrickhener

15 known vulnerabilities.

Products

goshs 15
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-50139

    goshs: Share-link ?token=… redemption races past download limit

    goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the s…

    patrickhener goshs goshs.de/goshs goshs.de/goshs/v2 Go
  • Medium 6.5
    CVE-2026-42091

    goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS

    goshs is a SimpleHTTPServer written in Go. Prior to version 2.0.2, the PUT upload handler (httpserver/updown.go) lacks the CSRF token validation that was added to the POST upload handler during the CVE-2026-40883 fix. Combined with the unconditional Access-Co…

    patrickhener goshs github.com/patrickhener/goshs github.com/patrickhener/goshs/v2 Go
  • Medium 6.1
    CVE-2026-40883

    goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation

    goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actio…

    patrickhener goshs github.com/patrickhener/goshs github.com/patrickhener/goshs/v2 Go