CVE-2026-40188

Published: Apr 10, 2026Modified: Jun 17, 2026

7.7

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Exploitability: 3.1 / Impact: 4.0

Source: security-advisories@github.com (Secondary)

Description

goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.

Affected (4)

Products: Goshs: Goshs

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Goshs Goshs	From 1.0.7 to 2.0.0
Goshs Goshs	Version 2.0.0 beta1
Goshs Goshs	Version 2.0.0 beta2
Goshs Goshs	Version 2.0.0 beta3

Related CWEs

Missing Write Protection for Parametric Data Values

The device does not write-protect the parametric data values for sensors that scale the sensor value, allowing untrusted software to manipulate the apparent result and potentially damage hardware or cause operational failure.

References (4)

https://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744

Source: security-advisories@github.com

Patch

https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.