CVE-2026-40876 Details
Description
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP root escape caused by prefix-based path validation. An authenticated SFTP user can read from and write to filesystem paths outside the configured SFTP root, which breaks the intended jail boundary and can expose or modify unrelated server files. The SFTP subsystem routes requests through sftpserver/sftpserver.go into DefaultHandler.GetHandler() in sftpserver/handler.go, which forwards file operations into readFile, writeFile, listFile, and cmdFile. All of those sinks rely on sanitizePath() in sftpserver/helper.go. helper.go uses a raw string-prefix comparison, not a directory-boundary check. Because of that, if the configured root is /tmp/goshsroot, then a sibling path such as /tmp/goshsroot_evil/secret.txt incorrectly passes validation since it starts with the same byte prefix. This vulnerability is fixed in 2.0.0-beta.6.
A path traversal vulnerability has been identified in goshs, a SimpleHTTPServer written in Go, prior to version 2.0.0-beta.6. This vulnerability allows authenticated SFTP users to escape the designated SFTP root directory and access or modify files outside of it. The issue arises from prefix-based path validation that fails to properly enforce directory boundaries, enabling users to read from and write to unrelated server files. The vulnerability is present in versions through 2.0.0-beta.5.
To address this vulnerability, it is recommended to replace the raw prefix check with a proper directory-boundary validation, ensuring that the SFTP root is correctly enforced. Reusing a hardened HTTP-style path sanitizer for SFTP file operations can also help maintain consistent boundary logic across different file-serving modes.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/patrickhener/goshs/security/advisories/GHSA-5h6h-7rc9-3824 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/patrickhener/goshs/security/advisories/GHSA-5h6h-7rc9-3824 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| goshs goshs | < 2.0.0 2.0.0 beta1 2.0.0 beta2 2.0.0 beta3 2.0.0 beta4 2.0.0 beta5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | New CVE Received | [email protected] |