{
  "cve_id": "CVE-2026-42091",
  "ghsa_id": "GHSA-rhf7-wvw3-vjvm",
  "package": "github.com/patrickhener/goshs",
  "vulnerability_type": "CWE-352 (Cross-Site Request Forgery)",
  "verdict": "CONFIRMED",
  "vulnerable_version": "v2.0.1",
  "fixed_version": "v2.0.2",
  "vulnerable_test": {
    "passed": true,
    "http_status": "200",
    "file_created": true,
    "details": "Cross-origin PUT request without CSRF token was accepted and file was written to disk"
  },
  "fixed_test": {
    "passed": true,
    "http_status": "403",
    "file_created": false,
    "details": "Cross-origin PUT request without CSRF token was rejected with 403 Forbidden"
  },
  "conclusion": "The vulnerability is confirmed. The PUT upload endpoint in goshs v2.0.1 lacks CSRF token validation, allowing arbitrary cross-origin file uploads. This is fixed in v2.0.2 by adding checkCSRF() to the PUT handler.",
  "reproduction_script": "repro/reproduction_steps.sh",
  "rca_report": "repro/rca_report.md",
  "timestamp": "2026-05-23T06:14:23Z"
}