The goshs SimpleHTTPServer written in Go had a CSRF vulnerability (CWE-352) in its PUT upload handler before version 2.0.2. While the POST upload handler was protected by CSRF token validation after a previous fix (CVE-2026-40883), the PUT handler did not receive the same protection. Additionally, the server responded to OPTIONS preflight requests with Access-Control-Allow-Origin: *, enabling cross-origin requests from any website. This combination allowed attackers to exploit victims' browsers to upload arbitrary files to goshs instances, potentially bypassing network isolation such as localhost or internal networks. The vulnerability is fixed in version 2.0.2.

Exploitation allows an attacker to write arbitrary files to a goshs server instance through a victim's browser, potentially leading to unauthorized file uploads and modification. This can bypass network isolation controls, increasing the risk of unauthorized access or manipulation of internal resources. The CVSS score of 6.5 reflects a medium severity with high impact on integrity but no direct confidentiality or availability impact.

This vulnerability is fixed in goshs version 2.0.2. Users should upgrade to version 2.0.2 or later to ensure the PUT upload handler includes CSRF token validation and to prevent unauthorized file uploads. No additional mitigations are specified or required beyond applying this official fix.