CSRF Vulnerability in goshs SimpleHTTPServer by Patrick Hener

CVE-2026-42091

What is CVE-2026-42091?

The goshs SimpleHTTPServer, developed by Patrick Hener, has a vulnerability related to CSRF tokens in its PUT upload handler. Versions prior to 2.0.2 lack proper token validation, allowing unauthorized file uploads from any website. Coupled with a permissive Access-Control-Allow-Origin header on the OPTIONS preflight handler, this flaw exposes goshs to potential exploitation, where files can be written to the server through the victim's browser without appropriate network isolation measures. This issue has been addressed in the release of version 2.0.2.

References