CVE-2026-40188

goshs is Missing Write Protection for Parametric Data Values

goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.

Affected

patrickhener · goshs

CVSS v3.1 GITHUB

7.7 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

EPSS

0.39% chance of exploitation in the next 30 days, 31st percentile

Published

2026-04-10

Updated

2026-04-13

Proof-of-concept exploits (1)

• advisories/GHSA-2943-crp8-38xx

Security advisories

• patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx
• patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744

References

• CVE Record
• NVD entry