CVE-2026-40188

goshs is Missing Write Protection for Parametric Data Values

CVSS 7.7 HIGHEPSS 0.3%CWE-1314

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.7EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

10 Apr 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Affected products

patrickhener · goshs

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744 https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4 https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx