CVE-2026-40189 is a critical authorization bypass in goshs, the Go based SimpleHTTPServer, scored CVSS 9.8. Before 2.0.0-beta.4, per folder .goshs access rules apply to reading but not to upload, mkdir or delete requests. Upgrade to 2.0.0-beta.4 or later. Treat it as urgent for any shared server.
What's affected
- Affected: goshs 2.0.0-beta.3 and earlier (the record says prior to 2.0.0-beta.4)
- Fixed: 2.0.0-beta.4
The advisory says directory listings and file reads honour the .goshs rules, while state changing routes do not. It lists PUT uploads, multipart POST to /upload, the mkdir query and the delete query. It also says deleting the .goshs file removes the folder's protection, which opens the previously protected content.
How to check if you're exposed
Check the version of the binary or image you run. For a Go module dependency:
go list -m all | grep goshs
For a container, check the image tag. Then check where goshs is listening and who can reach it. If you used .goshs files to protect folders and the server is reachable by others, assume the protection did not cover writes.
What to do now
- Upgrade goshs to 2.0.0-beta.4 or later.
- Stop running goshs on shared or public networks unless you need to. It is a convenience tool, not a hardened file server.
- Check protected folders for files you did not add and for missing .goshs files.
- Rotate anything stored in folders that were meant to be private.
Why it matters
The weakness is CWE-862, missing authorization. The control existed, but only some routes checked it. This is a common shape: access rules are added to the routes someone remembered, and the routes added later skip them.
The fix pattern from the advisory is to resolve the effective folder rules before any write and deny the request unless the caller satisfies them. The record does not report exploitation in the wild.
Quick check
Is goshs meant to be internet facing?
It is described as a simple HTTP server. If yours is reachable from untrusted networks, upgrade and reconsider that exposure.
Sources
Last reviewed: 19 October 2026.
