CVE-2026-40188: goshs is Missing Write Protection for Parametric Data Values

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-10 · updated 2026-10-26
Weakness: CWE-1314

Description

goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.

Affected products

patrickhener goshs: from 1.0.7 before 2.0.0; 2.0.0-beta1, 2.0.0-beta2, 2.0.0-beta3 — fixed in 2.0.0

How to fix

Upgrade to a fixed version: patrickhener goshs 2.0.0. Check the vendor advisory for mitigations.

References

https://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744
https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4
https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx
https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx

Get alerted when CVE-2026-40188 or the next vulnerability affects your stack