Description

goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.

INFO

Published Date :

2026-04-10T19:43:45.197Z

Last Modified :

2026-04-10T19:43:45.197Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-40188 vulnerability.

No data.

REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-40188.

URL Resource
https://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744 cve-icon cve-icon
https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4 cve-icon cve-icon
https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact