CVE-2026-40188 HIGH

CVE-2026-40188: goshs is Missing Write Protection for Parametric Data Values

Vendor Patrickhener

Product goshs

Weakness CWE-1314

Published April 10, 2026

Last update April 13, 2026

View on NVD All CVEs

CVSS base score

7.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

What the vulnerability does

01Description

goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.

Key dates

02Disclosure timeline

April 10, 2026 CVE published

April 13, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-40188 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1314.html