goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.
References
| Link | Resource |
|---|---|
| https://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744 | Patch |
| https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4 | Product Release Notes |
| https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx | Exploit Vendor Advisory |
| https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx | Exploit Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
14 Apr 2026, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:goshs:goshs:*:*:*:*:*:go:*:* cpe:2.3:a:goshs:goshs:2.0.0:beta3:*:*:*:go:*:* cpe:2.3:a:goshs:goshs:2.0.0:beta2:*:*:*:go:*:* cpe:2.3:a:goshs:goshs:2.0.0:beta1:*:*:*:go:*:* |
|
| References | () https://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744 - Patch | |
| References | () https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4 - Product, Release Notes | |
| References | () https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx - Exploit, Vendor Advisory | |
| First Time |
Goshs goshs
Goshs |
13 Apr 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx - |
10 Apr 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-10 20:16
Updated : 2026-04-14 20:15
NVD link : CVE-2026-40188
Mitre link : CVE-2026-40188
CVE.ORG link : CVE-2026-40188
JSON object : View
Products Affected
goshs
- goshs
CWE
CWE-1314
Missing Write Protection for Parametric Data Values