Threats tagged 'ghsa-rhf7-wvw3-vjvm'

A vulnerability in github.com/patrickhener/goshs/v2 allows arbitrary file write via a missing CSRF token validation on the PUT upload handler combined with a wildcard CORS policy. This enables any website visited by a victim to write or overwrite files in the goshs webroot through the victim's browser. The issue affects versions prior to 2.0.2 and 1.1.4 and has been assigned CVE-2026-42091.