CVE-2026-40188

HighCVSS 7.7/10Last modified Oct 26, 2026

Description

goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-1314

Affected software

Vendor	Product	Versions
patrickhener	goshs	>= 1.0.7, < 2.0.0-beta.4

References

https://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744Patch
https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4Product, Release Notes
https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xxExploit, Vendor Advisory
https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xxExploit, Vendor Advisory

Timeline

Published: Apr 10, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-401899.8goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism f CVE-2026-40195.3The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions up to, and including CVE-2026-401909.8LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (l CVE-2026-401916.8ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.4-beta-1f46165, Clearance CVE-2026-401927.5Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FIT CVE-2026-401938.2maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where CVE-2026-401943.7phpseclib is a PHP secure communications library. Starting in 0.1.1 and prior to 3.0.51, 2.0.53, and 1.0.28, phpseclib\Net\SSH2::get_binary_CVE-2026-401956.5Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import log CVE-2026-401968.1HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained per CVE-2026-401976.5Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import log CVE-2026-401987.5Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass. _pack_ipv6() does not chec CVE-2026-401996.5Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass. _pack_ipv6() includes t