CVE-2026-40188

goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744	Patch
https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4	Product Release Notes
https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx	Exploit Vendor Advisory
https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:goshs:goshs::::::go::*
	cpe:2.3:a:goshs:goshs:2.0.0:beta1::::go::*
	cpe:2.3:a:goshs:goshs:2.0.0:beta2::::go::*
	cpe:2.3:a:goshs:goshs:2.0.0:beta3::::go::*

History

No history.

Information

Published : 2026-04-10 20:16

Updated : 2026-06-17 10:44

NVD link : CVE-2026-40188

Mitre link : CVE-2026-40188

CVE.ORG link : CVE-2026-40188

JSON object : View

Products Affected

goshs

goshs

CWE

CWE-1314

Missing Write Protection for Parametric Data Values

{"id": "CVE-2026-40188", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40188", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T15:28:25.294603Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "patrickhener", "product": "goshs", "versions": [{"status": "affected", "version": ">= 1.0.7, < 2.0.0-beta.4"}]}]}], "published": "2026-04-10T20:16:23.733", "references": [{"url": "https://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1314"}]}], "descriptions": [{"lang": "en", "value": "goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4."}], "lastModified": "2026-06-17T10:44:50.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:goshs:goshs:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "1CC7DF19-7DCC-4ACF-B4ED-789E769A8B3F", "versionEndExcluding": "2.0.0", "versionStartIncluding": "1.0.7"}, {"criteria": "cpe:2.3:a:goshs:goshs:2.0.0:beta1:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "047ECFC3-056F-4FAC-9B64-5F7C120CFFE1"}, {"criteria": "cpe:2.3:a:goshs:goshs:2.0.0:beta2:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "6EA86AD2-EE6D-4427-9434-A9A49A4D38F9"}, {"criteria": "cpe:2.3:a:goshs:goshs:2.0.0:beta3:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "F44CF6A3-C1BC-4636-A1D5-1ED69A340FE3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}