goshs implements a simple HTTP file upload service. In versions prior to 2.0.2 the PUT handler does not enforce CSRF protection, while the OPTIONS preflight handler sends an "Access‑Control‑Allow‑Origin: *" header. As a result, any web page that the victim visits can instruct the victim’s browser to perform a PUT request to the server and upload or overwrite an arbitrary file, thereby modifying the server’s file system. The CWE-352 classification reflects the cross‑site request forgery nature of this flaw.

The vulnerable code is present in the goshs SimpleHTTPServer package produced by patrickhener. All releases before v2.0.2 contain the flaw; v2.0.2 adds CSRF validation for uploaded files and removes the wildcard CORS header, thereby patching the issue.

The CVSS score of 6.5 marks it as a medium‑level vulnerability. Because the exploit requires a victim browser to load a malicious site, the attack vector is client‑side; it can bypass network isolation such as localhost or internal networks. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that no public exploits have been reported at the time of assessment. Nonetheless, the ability to write arbitrary files could enable malware deployment or configuration tampering if the server is accessible to unprivileged users.