goshs tiene CSRF en rutas GET que modifican el estado, lo que permite la eliminación de archivos y la creación de directorios autenticados

The primary impact of this CSRF vulnerability lies in the potential for unauthorized modification of the goshs server's file system. An attacker could leverage this to delete critical files, create malicious directories, or otherwise disrupt the server's operation. Because goshs is often used in automation and configuration management scenarios, successful exploitation could lead to broader system compromise. The lack of CSRF protection on state-changing GET routes, combined with reliance on HTTP basic authentication, makes this vulnerability particularly concerning. This is similar to other CSRF vulnerabilities where an attacker can trick a user into performing actions they did not intend to.

Organizations and individuals using goshs version 2.0.0-beta.4 through 2.0.0-beta.5, particularly those deploying goshs in automated environments or as part of configuration management systems, are at significant risk. Shared hosting environments where multiple users share a goshs instance are also particularly vulnerable.

• linux / server:

ps aux | grep goshs

• generic web:

curl -I https://your-goshs-server.com/?mkdir
curl -I https://your-goshs-server.com/?delete

Check access logs for unusual GET requests to / with parameters like ?mkdir or ?delete originating from unexpected IP addresses.

1. 2026-04-21Disclosure

   disclosure

1. Reservado2026-04-15
2. Publicada2026-04-21
3. EPSS actualizado2026-04-29

The recommended mitigation for CVE-2026-40883 is to immediately upgrade to goshs version 2.0.0-beta.6 or later, which includes the necessary CSRF protections. If upgrading is not immediately feasible, consider implementing a reverse proxy or web application firewall (WAF) with CSRF protection rules to filter out malicious requests. Additionally, restrict access to the vulnerable GET routes (?mkdir, ?delete) to trusted networks or users. While not a complete solution, enforcing stricter HTTP headers (e.g., Origin and Referer validation) can provide an additional layer of defense. After upgrading, confirm the fix by attempting to trigger the vulnerable actions from a different browser session or incognito window to ensure CSRF protection is active.