Read the docs
TI-2026-29532 Aliases CVE-2026-40876GHSA-5h6h-7rc9-3824

SFTP root escape via prefix-based path validation in goshs

Priority HIGH 73CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP root escape caused by prefix-based path validation. An authenticated SFTP user can read from and write to filesystem paths outside the configured SFTP root, which breaks the intended jail boundary and can expose or modify unrelated server files. The SFTP subsystem routes requests through sftpserver/sftpserver.go into DefaultHandler.GetHandler() in sftpserver/handler.go, which forwards file operations into readFile, writeFile, listFile, and cmdFile. All of those sinks rely on sanitizePath() in sftpserver/helper.go. helper.go uses a raw string-prefix comparison, not a directory-boundary check. Because of that, if the configured root is /tmp/goshsroot, then a sibling path such as /tmp/goshsroot_evil/secret.txt incorrectly passes validation since it starts with the same byte prefix. This vulnerability is fixed in 2.0.0-beta.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00439 38th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed goshs (patrickhener): 2.0.0-beta.6github.com/patrickhener/goshs/v2 (Go): 2.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
patrickhenergoshsbefore 2.0.0-beta.62.0.0-beta.6Patch availableCNA
—github.com/patrickhener/goshs (Go)up to 1.1.4—No fix listedGHSA-5h6h-7rc9-3824
—github.com/patrickhener/goshs/v2 (Go)before 2.0.02.0.0Patch availableGHSA-5h6h-7rc9-3824
  • goshs Vendorpatrickhener Affected before 2.0.0-beta.6 Fixed in 2.0.0-beta.6 Patch available CNA
  • github.com/patrickhener/goshs (Go) Vendor— Affected up to 1.1.4 Fixed in — No fix listed GHSA-5h6h-7rc9-3824
  • github.com/patrickhener/goshs/v2 (Go) Vendor— Affected before 2.0.0 Fixed in 2.0.0 Patch available GHSA-5h6h-7rc9-3824

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:goshs:goshs:*:*:*:*:*:go:*:*before 2.0.0Vulnerablepatrickhener
cpe:2.3:a:goshs:goshs:2.0.0:beta1:*:*:*:go:*:*2.0.0 beta1Vulnerablepatrickhener
cpe:2.3:a:goshs:goshs:2.0.0:beta2:*:*:*:go:*:*2.0.0 beta2Vulnerablepatrickhener
cpe:2.3:a:goshs:goshs:2.0.0:beta3:*:*:*:go:*:*2.0.0 beta3Vulnerablepatrickhener
cpe:2.3:a:goshs:goshs:2.0.0:beta4:*:*:*:go:*:*2.0.0 beta4Vulnerablepatrickhener
cpe:2.3:a:goshs:goshs:2.0.0:beta5:*:*:*:go:*:*2.0.0 beta5Vulnerablepatrickhener
  • cpe:2.3:a:goshs:goshs:*:*:*:*:*:go:*:* Versions before 2.0.0 Vulnerable ·patrickhener
  • cpe:2.3:a:goshs:goshs:2.0.0:beta1:*:*:*:go:*:* Versions 2.0.0 beta1 Vulnerable ·patrickhener
  • cpe:2.3:a:goshs:goshs:2.0.0:beta2:*:*:*:go:*:* Versions 2.0.0 beta2 Vulnerable ·patrickhener
  • cpe:2.3:a:goshs:goshs:2.0.0:beta3:*:*:*:go:*:* Versions 2.0.0 beta3 Vulnerable ·patrickhener
  • cpe:2.3:a:goshs:goshs:2.0.0:beta4:*:*:*:go:*:* Versions 2.0.0 beta4 Vulnerable ·patrickhener
  • cpe:2.3:a:goshs:goshs:2.0.0:beta5:*:*:*:go:*:* Versions 2.0.0 beta5 Vulnerable ·patrickhener

Remediation

  • Fix · CNA goshs (patrickhener) Fixed in 2.0.0-beta.6
  • Fix · GHSA-5h6h-7rc9-3824 github.com/patrickhener/goshs/v2 (Go) Fixed in 2.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40876
  2. 2026-10-03 Alias added: GHSA-5h6h-7rc9-3824

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-29540 goshs: Empty-username SFTP password authentication bypass in goshs CVSS 3.1CRITICAL 9.8
  • TI-2026-27601 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs CVSS 3.0CRITICAL 9.8
  • TI-2026-27529 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload CVSS 3.0CRITICAL 9.8
  • TI-2026-27528 goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload CVSS 3.0CRITICAL 9.8
  • TI-2026-29003 goshs has a file-based ACL authorization bypass in goshs state-changing routes CVSS 4.0CRITICAL 9.3
  • TI-2026-26829 goshs has Auth Bypass via Share Token CVSS 3.1HIGH 8.1
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences