HarborGuard / CVE
Back to search
HIGHCVE-2026-40188Published Modified CNA GitHub_M

CVE-2026-40188: goshs is Missing Write Protection for Parametric Data Values

goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.

Metrics

CVSS v3.1
7.7
Severity
HIGH
Fixed in
—
Affected Products
1
Affected packages
  • patrickhener / goshs
    >= 1.0.7, < 2.0.0-beta.4
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
References