PT-2026-32038

CVE-2026-40188

Published

2026-04-10

Updated

2026-07-30

Description by

CVSS 3.1

7.7

High

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: goshs versions 1.0.7 through 2.0.0-beta.4

Description: goshs is a SimpleHTTPServer written in Go. The SFTP command rename sanitizes only the source path and not the destination, allowing a write outside of the root directory of the SFTP. This can be used for file write, potentially leading to remote code execution by overwriting SSH keys or configuration files.

Recommendations: Update to goshs version 2.0.0-beta.4 or later.

Exploitability

Exploit

Fix

Researchers

Marduc812

Vendors

Affected products

Weakness enumeration

CWE-1314: Missing Write Protection for Parametric Data Values

Related identifiers

CVE-2026-40188