goshs contains a CSRF flaw in its state‑changing HTTP GET routes that allows an attacker to prompt an authenticated browser to perform destructive actions such as deleting files or creating directories. The server trusts only HTTP Basic authentication and performs no CSRF, Origin or Referer validation for these routes, so a malicious link or embedded image can trigger the operations. The primary impact is loss of data and configuration changes conducted with the privileges of the authenticated actor.

The offender is the open‑source web server goshs, maintained by patrickhener. Versions from 2.0.0‑beta.4 through 2.0.0‑beta.5 are affected. The issue was corrected in version 2.0.0‑beta.6 and later releases.

The CVSS score of 6.1 classifies the vulnerability as moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, indicating no known active exploitation reports. Exploit requires a victim to be authenticated to the server; an attacker can craft a link containing the ?delete or ?mkdir parameters and lure the victim into clicking it, which would trigger the destructive action without additional credentials. This makes the vulnerability potentially valuable for insiders or attackers who have already compromised a user’s session or device.