CVE-2026-40188

goshs is Missing Write Protection for Parametric Data Values

CVSS 7.7 HIGHEPSS 0.3%CWE-1314

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.7EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

10 abr 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Produtos afetados

patrickhener · goshs

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744 https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4 https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx