CVE-2026-40188

HIGH

goshs is Missing Write Protection for Parametric Data Values

Title source: cna
STIX 2.1

Description

goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.

References (3)

Core 3

Scores

CVSS v3 7.7
EPSS 0.0032
EPSS Percentile 23.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-1314
Status published
Products (4)
goshs/goshs 2.0.0 beta1 (3 CPE variants)
goshs/goshs 1.0.7 - 2.0.0
patrickhener/goshs 1.0.7 - 1.1.4Go
patrickhener/goshs >= 1.0.7, < 2.0.0-beta.4
Published Apr 10, 2026
Tracked Since Apr 11, 2026