CVE-2026-40188
Goshs 1.0.7 – 2.0.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:NSummary
CVE-2026-40188 is a high-severity Missing Write Protection for Parametric Data Values (CWE-1314) vulnerability in Goshs Goshs. Its CVSS base score is 7.7 (High).
Operationally, ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-40188 affects goshs, a SimpleHTTPServer written in Go, in versions from 1.0.7 up to but not including 2.0.0-beta.4. The vulnerability lies in the SFTP command's rename functionality, which sanitizes only the source path and neglects the destination path. This flaw, classified under CWE-1314 (Missing Sanitization of Special Element), enables directory traversal by allowing writes outside the configured SFTP root directory. It carries a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), indicating high severity due to its network accessibility and integrity impact.
An attacker with low-privilege SFTP access, such as an authenticated user, can exploit this over the network with low complexity and no user interaction required. By crafting a rename operation with a malicious destination path (e.g., using path traversal sequences like "../"), the attacker achieves scope change across the system, enabling arbitrary file writes outside the SFTP root. This could lead to overwriting critical files, escalating privileges, or disrupting services, though it does not directly impact confidentiality or availability.
The vulnerability is addressed in goshs version 2.0.0-beta.4, where the destination path sanitization was properly implemented, as detailed in the project's security advisory (GHSA-2943-crp8-38xx), release notes, and the fixing commit (141c188ce270ffbec087844a50e5e695b7da7744). Security practitioners should upgrade to 2.0.0-beta.4 or later and review SFTP configurations to enforce strict root directory isolation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21589
Vulnerability Data
goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This…
more
vulnerability is fixed in 2.0.0-beta.4.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement stops unapproved logical writes to protected parametric values.
Hardware-enforced write protection directly stops unauthorized modification of parametric sensor data.
Least privilege limits which processes can alter sensor scaling data.
Enforces access restrictions on configuration changes, blocking untrusted writes to scaling parameters.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Least-privilege access permissions directly prevent untrusted software from writing parametric sensor data.
Integrity protection for data-at-rest includes write protection of device parametric values.
Configuration-management practices enforce protection of sensor scaling parameters.
Logical-access controls reduce the attack surface for unauthorized writes to device parameters.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure system architecture and engineering principles require hardware-level write-protection for critical sensor parameters.
Secure coding practices can prevent software from writing to protected parameter areas but do not address the underlying hardware protection gap.
Configuration management enforces write-protection and integrity checks on parametric/sensor calibration data.
Change management can restrict unauthorized updates to calibration values but does not enforce the technical write-protection mechanism.