{
  "ticket_id": "CVE-2026-42091",
  "code_root": "external/goshs",
  "source": {
    "type": "cve",
    "cve_id": "CVE-2026-42091",
    "advisory_id": "GHSA-rhf7-wvw3-vjvm",
    "advisory_url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-rhf7-wvw3-vjvm",
    "vendor": "patrickhener",
    "product": "goshs",
    "repo": "https://github.com/patrickhener/goshs"
  },
  "facts": {
    "cve_id": "CVE-2026-42091",
    "advisory_id": "GHSA-rhf7-wvw3-vjvm",
    "issue_summary": "The PUT upload handler in httpserver/updown.go lacks the CSRF token that the POST handler requires. Combined with permissive CORS (Access-Control-Allow-Origin: * on the OPTIONS preflight), any cross-origin page can issue a PUT and write arbitrary files to a goshs server reachable from the victim's browser. The fix adds CSRF-token validation to PUT.",
    "vulnerability_type": "Cross-Site Request Forgery",
    "suspected_cwe": ["CWE-352"],
    "affected_versions": "<= v2.0.1",
    "fixed_versions": ["v2.0.2"],
    "reproduce_version": "v2.0.1",
    "verify_fixed_version": "v2.0.2",
    "repo_url": "https://github.com/patrickhener/goshs.git",
    "fix_commit": "0e715b94e10c3d1aa552276000f15f104dee2f32",
    "code_root": "external/goshs",
    "ecosystem": "go",
    "package": "github.com/patrickhener/goshs",
    "affected_components": ["httpserver/updown.go (PUT upload handler)"],
    "install_recipe": "Build goshs from source at the specified git tag: `git clone https://github.com/patrickhener/goshs && cd goshs && git checkout v2.0.1` (vulnerable) or `git checkout v2.0.2` (fixed), then `go build ./...`. Release binaries on the GitHub Releases page are equivalent.",
    "attacker_access": "Any web page the victim visits while a goshs upload server is reachable from the victim's browser (loopback, LAN, etc.). The exploit is browser-initiated cross-origin, but for repro the cross-origin request can be modeled with curl.",
    "primary_entry_point": "HTTP PUT /<path> on a goshs server started with upload enabled (`-u`)",
    "exploit_outline": "Build goshs v2.0.1 (vulnerable) vs v2.0.2 (fixed), start it with upload enabled on a local port. Issue an HTTP PUT to /pwned.txt with a body like `pwned` and no CSRF token: `curl -X PUT --data-binary 'pwned' http://localhost:<port>/pwned.txt`.",
    "vulnerable_indicator": "The PUT is accepted (typically HTTP 2xx) and `pwned.txt` appears in the goshs upload directory.",
    "fixed_indicator": "The PUT is rejected (HTTP 403) by the new CSRF check; no `pwned.txt` is written to the upload directory.",
    "reproduction_requirements": "Go toolchain (for building goshs at the specified tag) and curl. No browser, database, or external service required - the cross-origin PUT is modeled with a single curl invocation, since the vulnerability is that the server accepts the PUT at all without a CSRF token.",
    "notes": "The advisory notes permissive CORS as a contributing factor (it makes the cross-origin PUT actually reachable from a browser), but the deliverable observable for the repro is the missing CSRF check on PUT - which can be exercised directly with curl."
  }
}