Authorization Bypass in goshs SimpleHTTPServer by Patrick Hener

CVE-2026-40189

What is CVE-2026-40189?

The goshs SimpleHTTPServer, prior to version 2.0.0-beta.4, suffers from an authorization bypass flaw. The application implements access control for folder listings through a .goshs file but fails to apply these checks on state-changing routes. This vulnerability allows unauthenticated users to upload files via PUT requests, create directories, and delete files within directories that should be protected. By removing the .goshs file, attackers can expose restricted content, compromising the confidentiality, integrity, and availability of the system. Users are encouraged to upgrade to the latest version to mitigate this risk.

References