CVE-2026-40883: CSRF in goshs State-Changing Routes

The primary impact of this CSRF vulnerability lies in the potential for unauthorized modification of the goshs server's file system. An attacker could leverage this to delete critical files, create malicious directories, or otherwise disrupt the server's operation. Because goshs is often used in automation and configuration management scenarios, successful exploitation could lead to broader system compromise. The lack of CSRF protection on state-changing GET routes, combined with reliance on HTTP basic authentication, makes this vulnerability particularly concerning. This is similar to other CSRF vulnerabilities where an attacker can trick a user into performing actions they did not intend to.

1. Reserved2026-04-15
2. Published2026-04-21
3. EPSS updated2026-04-29

The recommended mitigation for CVE-2026-40883 is to immediately upgrade to goshs version 2.0.0-beta.6 or later, which includes the necessary CSRF protections. If upgrading is not immediately feasible, consider implementing a reverse proxy or web application firewall (WAF) with CSRF protection rules to filter out malicious requests. Additionally, restrict access to the vulnerable GET routes (?mkdir, ?delete) to trusted networks or users. While not a complete solution, enforcing stricter HTTP headers (e.g., Origin and Referer validation) can provide an additional layer of defense. After upgrading, confirm the fix by attempting to trigger the vulnerable actions from a different browser session or incognito window to ensure CSRF protection is active.