CVE-2026-40883: 
NixOS vulnerability analysis and mitigation

CVE-2026-40883 is a Cross-Site Request Forgery (CSRF) vulnerability in goshs, a SimpleHTTPServer written in Go. Affecting versions 2.0.0-beta.4 and 2.0.0-beta.5, the flaw exists in state-changing HTTP GET routes (?delete and ?mkdir) that rely solely on HTTP basic authentication without any CSRF, Origin, or Referer validation. It was published on April 21, 2026, and patched in version 2.0.0-beta.6. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 6.1 (Medium) (GitHub Advisory).

The root cause is CWE-352 (Cross-Site Request Forgery): goshs dispatches ?mkdir to handleMkdir() and ?delete to deleteFile() via standard HTTP GET requests (handler.go lines 118–123 and 180–186), with authentication enforced only by HTTP basic auth (middleware.go lines 20–87). Because browsers automatically replay cached HTTP basic-auth credentials on subresource requests (e.g., <img> tags), an attacker-controlled page can embed image tags pointing to goshs endpoints such as <img src="http://target:18095/victim.txt?delete">, causing the victim's authenticated browser to issue the destructive request without user intent. The filesystem mutation sinks os.RemoveAll() (handler.go:683–718) and os.MkdirAll() (handler.go:961–1000) are then invoked with the victim's credentials. A detailed PoC with embedded HTML payloads and a complete automation script is publicly available (GitHub Advisory).

Successful exploitation allows an unauthenticated external attacker to abuse an authenticated victim's browser session to perform unauthorized filesystem mutations on the goshs server — specifically deleting arbitrary files via ?delete and creating directories via ?mkdir. There is no confidentiality impact (no data exfiltration), but integrity and availability are both highly impacted, as critical files can be permanently deleted using os.RemoveAll(). Any goshs deployment using HTTP basic auth for web access is exposed whenever an authenticated user visits attacker-controlled content (GitHub Advisory).

A public proof-of-concept exploit is available in the GitHub Security Advisory, including step-by-step instructions, HTML payloads, and a complete automation script using Playwright to simulate victim browser actions. The EPSS score is 0.019% (very low probability of widespread exploitation), and there is no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify a target running goshs version 2.0.0-beta.4 or 2.0.0-beta.5, accessible via a browser with HTTP basic authentication enabled.
2. Prepare attacker-controlled pages: Host malicious HTML pages on an attacker-controlled server (e.g., python3 -m http.server 18889). The delete.html page embeds <img src="http://<target>:<port>/victim.txt?delete"> and mkdir.html embeds <img src="http://<target>:<port>/csrfmade?mkdir">.
3. Trick the victim: Social-engineer the authenticated goshs user into visiting the attacker's pages (e.g., via phishing link or malicious redirect) while their browser session is authenticated to goshs.
4. Browser replays credentials: The victim's browser automatically sends the cached HTTP basic-auth credentials with the subresource <img> requests to the goshs server.
5. Server executes state changes: goshs processes the GET requests as authenticated, calling os.RemoveAll() to delete the target file and os.MkdirAll() to create the attacker-specified directory.
6. Verify impact: The attacker can confirm success by checking whether the target file is deleted and the new directory exists on the goshs server (GitHub Advisory).

• Network: Unexpected HTTP GET requests to goshs endpoints containing ?delete or ?mkdir query parameters originating from browser user-agents (rather than direct CLI tools); requests with a Referer header pointing to an external or unknown domain.
• Logs: goshs access logs showing GET requests to /<filename>?delete or /<dirname>?mkdir with valid basic-auth credentials but a Referer from a different origin; repeated requests in rapid succession suggesting automated browser-based triggering.
• File System: Unexpected deletion of files in the goshs-served directory (e.g., files present before a user session that are missing afterward); unexpected new directories created (e.g., directories with unusual names like csrfmade) in the goshs root directory.
• Process: os.RemoveAll() or os.MkdirAll() operations logged or observable via filesystem audit tools (e.g., auditd, inotifywait) triggered during periods of user browser activity (GitHub Advisory).

Upgrade goshs to version 2.0.0-beta.6 or later, which addresses this vulnerability. As interim mitigations, administrators should restrict access to goshs instances so that authenticated users cannot be tricked into visiting external pages while authenticated, or place goshs behind a reverse proxy that enforces strict CSRF protections. The vendor's advisory recommends moving state-changing operations (?delete, ?mkdir) off GET routes to non-idempotent HTTP methods (POST/DELETE), adding per-request CSRF tokens, and enforcing strict Origin and Referer header validation (GitHub Advisory).

The vulnerability was reported by security researcher R1ZZG0D and disclosed via GitHub's security advisory program. Coverage has appeared on several CVE aggregation and threat intelligence platforms including cvefeed.io, vuldb.com, and radar.offseq.com. No significant vendor statements beyond the official advisory or notable broader media coverage have been identified at this time (GitHub Advisory).