goshs is Missing Write Protection for Parametric Data Values
Priority HIGH 67CWE-1314Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00324 25th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed goshs (patrickhener): 2.0.0-beta.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| patrickhener | goshs | 1.0.7 to before 2.0.0-beta.4 | 2.0.0-beta.4 | Patch available | CNA |
| — | github.com/patrickhener/goshs (Go) | 1.0.7 – 1.1.4 | — | No fix listed | GHSA-2943-crp8-38xx |
- goshs Vendorpatrickhener Affected 1.0.7 to before 2.0.0-beta.4 Fixed in 2.0.0-beta.4 Patch available CNA
- github.com/patrickhener/goshs (Go) Vendor— Affected 1.0.7 – 1.1.4 Fixed in — No fix listed GHSA-2943-crp8-38xx
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:goshs:goshs:*:*:*:*:*:go:*:* | 1.0.7 to before 2.0.0 | Vulnerable | patrickhener |
| cpe:2.3:a:goshs:goshs:2.0.0:beta1:*:*:*:go:*:* | 2.0.0 beta1 | Vulnerable | patrickhener |
| cpe:2.3:a:goshs:goshs:2.0.0:beta2:*:*:*:go:*:* | 2.0.0 beta2 | Vulnerable | patrickhener |
| cpe:2.3:a:goshs:goshs:2.0.0:beta3:*:*:*:go:*:* | 2.0.0 beta3 | Vulnerable | patrickhener |
- cpe:2.3:a:goshs:goshs:*:*:*:*:*:go:*:* Versions 1.0.7 to before 2.0.0 Vulnerable ·patrickhener
- cpe:2.3:a:goshs:goshs:2.0.0:beta1:*:*:*:go:*:* Versions 2.0.0 beta1 Vulnerable ·patrickhener
- cpe:2.3:a:goshs:goshs:2.0.0:beta2:*:*:*:go:*:* Versions 2.0.0 beta2 Vulnerable ·patrickhener
- cpe:2.3:a:goshs:goshs:2.0.0:beta3:*:*:*:go:*:* Versions 2.0.0 beta3 Vulnerable ·patrickhener
Remediation
- Fix · CNA goshs (patrickhener) Fixed in 2.0.0-beta.4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-40188
- 2026-10-03 Alias added: GHSA-2943-crp8-38xx
References
More patrickhener Goshs vulnerabilities
- TI-2026-29540 goshs: Empty-username SFTP password authentication bypass in goshs CVSS 3.1CRITICAL 9.8
- TI-2026-27601 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs CVSS 3.0CRITICAL 9.8
- TI-2026-27529 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload CVSS 3.0CRITICAL 9.8
- TI-2026-27528 goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload CVSS 3.0CRITICAL 9.8
- TI-2026-29003 goshs has a file-based ACL authorization bypass in goshs state-changing routes CVSS 4.0CRITICAL 9.3
- TI-2026-29532 SFTP root escape via prefix-based path validation in goshs CVSS 4.0HIGH 8.7
Sources
- CVE-2026-40188 · CVE Program
- CVE-2026-40188 · NVD
- FIRST EPSS
- GHSA-2943-crp8-38xx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences