CVE-2026-40188
Published: 10 April 2026
Summary
CVE-2026-40188 is a high-severity Missing Write Protection for Parametric Data Values (CWE-1314) vulnerability in Goshs Goshs. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Ingress Tool Transfer (T1105); ranked at the 8.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates validation and sanitization of SFTP rename destination paths to block directory traversal sequences like '../' outside the root directory.
Requires monitoring for and timely remediation of the specific path sanitization flaw by applying patches to goshs version 2.0.0-beta.4 or later.
Enforces approved access authorizations in the SFTP server to restrict file writes to the configured root directory, mitigating unauthorized traversal writes.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SFTP rename path traversal allows arbitrary file writes outside the root, directly enabling ingress of tools/files to any system location (T1105) and privilege escalation via overwriting critical files (T1068).
NVD Description
goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This…
more
vulnerability is fixed in 2.0.0-beta.4.
Deeper analysisAI
CVE-2026-40188 affects goshs, a SimpleHTTPServer written in Go, in versions from 1.0.7 up to but not including 2.0.0-beta.4. The vulnerability lies in the SFTP command's rename functionality, which sanitizes only the source path and neglects the destination path. This flaw, classified under CWE-1314 (Missing Sanitization of Special Element), enables directory traversal by allowing writes outside the configured SFTP root directory. It carries a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), indicating high severity due to its network accessibility and integrity impact.
An attacker with low-privilege SFTP access, such as an authenticated user, can exploit this over the network with low complexity and no user interaction required. By crafting a rename operation with a malicious destination path (e.g., using path traversal sequences like "../"), the attacker achieves scope change across the system, enabling arbitrary file writes outside the SFTP root. This could lead to overwriting critical files, escalating privileges, or disrupting services, though it does not directly impact confidentiality or availability.
The vulnerability is addressed in goshs version 2.0.0-beta.4, where the destination path sanitization was properly implemented, as detailed in the project's security advisory (GHSA-2943-crp8-38xx), release notes, and the fixing commit (141c188ce270ffbec087844a50e5e695b7da7744). Security practitioners should upgrade to 2.0.0-beta.4 or later and review SFTP configurations to enforce strict root directory isolation.
Details
- CWE(s)