CVE-2026-40188 patrickhener CVE debrief

Who should care

Defenders responsible for goshs installations, SFTP server administrators, and security teams should assess exposure and prioritize updates. They should verify and update goshs installations to prevent potential security bypass via directory traversal. Security teams should review SFTP server configurations to prevent unauthorized data writes and monitor for potential exploitation attempts.

Why it matters

Defenders should care about CVE-2026-40188 as it allows writing outside the root directory of the SFTP server in goshs, potentially leading to unauthorized data writes. Versions from 1.0.7 to before 2.0.0-beta.4 are affected, and updating to 2.0.0-beta.4 or later is recommended.

• Potential unauthorized data writes via SFTP
• Need to verify and update goshs installations
• Possible security bypass via directory traversal

Technical summary

The goshs SimpleHTTPServer written in Go has a vulnerability in its SFTP command rename functionality, allowing writing outside the root directory of the SFTP server. This issue is fixed in version 2.0.0-beta.4. The vulnerability is caused by the SFTP command rename functionality sanitizing only the source path and not the destination. This could lead to unauthorized data writes via SFTP. Defenders should prioritize verifying and updating goshs installations to prevent potential unauthorized data writes via directory traversal.

Defensive priority

Defenders should prioritize verifying and updating goshs installations to prevent potential unauthorized data writes.

Recommended defensive actions

• Verify goshs version and update to 2.0.0-beta.4 or later if vulnerable
• Review SFTP server configurations to prevent unauthorized data writes
• Monitor for potential exploitation attempts
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. The vulnerability allows writing outside the root directory of the SFTP server in goshs. The issue is fixed in version 2.0.0-beta.4. The CVE record was published on 2026-04-10T20:16:23.733Z and has not been modified since then. The NVD entry provides additional information on the vulnerability and its impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.