goshs has Cross-Origin Arbitrary File Write via Missing CSRF on PUT and Wildcard CORS

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-42091 · Microsoft / collected KEV context

EUVD-2026-27067

GHSA-rhf7-wvw3-vjvm

GO-2026-5625

cve-program · CVE-2026-42091

• https://github.com/patrickhener/goshs/security/advisories/GHSA-rhf7-wvw3-vjvm
• https://github.com/patrickhener/goshs/commit/0e715b94e10c3d1aa552276000f15f104dee2f32
• https://github.com/patrickhener/goshs/releases/tag/v2.0.2

euvd · EUVD-2026-27067

• https://github.com/patrickhener/goshs/security/advisories/GHSA-rhf7-wvw3-vjvm
• https://github.com/patrickhener/goshs/commit/0e715b94e10c3d1aa552276000f15f104dee2f32
• https://github.com/patrickhener/goshs/releases/tag/v2.0.2

nvd · CVE-2026-42091

• https://github.com/patrickhener/goshs/commit/0e715b94e10c3d1aa552276000f15f104dee2f32
• https://github.com/patrickhener/goshs/releases/tag/v2.0.2
• https://github.com/patrickhener/goshs/security/advisories/GHSA-rhf7-wvw3-vjvm

osv · GHSA-rhf7-wvw3-vjvm

• https://github.com/patrickhener/goshs/security/advisories/GHSA-rhf7-wvw3-vjvm
• https://nvd.nist.gov/vuln/detail/CVE-2026-42091
• https://github.com/patrickhener/goshs/commit/0e715b94e10c3d1aa552276000f15f104dee2f32
• https://github.com/patrickhener/goshs
• https://github.com/patrickhener/goshs/releases/tag/v2.0.2

osv · GO-2026-5625

• https://github.com/patrickhener/goshs/security/advisories/GHSA-rhf7-wvw3-vjvm
• https://nvd.nist.gov/vuln/detail/CVE-2026-42091
• https://github.com/patrickhener/goshs/commit/0e715b94e10c3d1aa552276000f15f104dee2f32
• https://github.com/patrickhener/goshs/releases/tag/v2.0.2

No related operational record is retained in the current change model.