CVE-2026-40188
High · 7.7CVSS
7.7
EPSS
0.4%
Published
Apr 10, 2026
CISA due date
—
The record
goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | goshs | 0 | 2.0.0-1.1 |
Related vulnerabilities
- CVE-2026-40189 goshs is a SimpleHTTPServer written in Go. Also affects goshs
- CVE-2026-35471 goshs is a SimpleHTTPServer written in Go. Also affects goshs
- CVE-2026-35392 goshs is a SimpleHTTPServer written in Go. Also affects goshs
- CVE-2026-35393 goshs is a SimpleHTTPServer written in Go. Also affects goshs