CVE-2026-40876

HighPublic PoC

Published: 21 April 2026

Published

21 April 2026

Modified

24 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0005 16.0th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-40876 is a high-severity Path Traversal (CWE-22) vulnerability in Goshs Goshs. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 3 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Requires validation of SFTP path inputs to prevent path traversal attacks exploiting flawed prefix-based checks in sanitizePath().

SI-2 Flaw Remediation good match

prevent

Directly mitigates the vulnerability by applying the vendor fix in version 2.0.0-beta.6 or later to remediate the path sanitization flaw.

AC-3 Access Enforcement partial match

prevent

Enforces authorized access to filesystem paths within the SFTP root, countering escapes via crafted sibling paths like /tmp/goshsroot_evil/secret.txt.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1083 File and Directory Discovery Discovery

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

attack.mitre.org →

T1105 Ingress Tool Transfer Command And Control

Adversaries may transfer tools or other files from an external system into a compromised environment.

attack.mitre.org →

Why these techniques?

Path traversal in SFTP server directly enables exploitation of public-facing app (T1190) for arbitrary local file read (T1005), directory listing (T1083), and file writes for tool ingress (T1105).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP root escape caused by prefix-based path validation. An authenticated SFTP user can read from and write to filesystem paths outside the configured SFTP root, which breaks…

the intended jail boundary and can expose or modify unrelated server files. The SFTP subsystem routes requests through sftpserver/sftpserver.go into DefaultHandler.GetHandler() in sftpserver/handler.go, which forwards file operations into readFile, writeFile, listFile, and cmdFile. All of those sinks rely on sanitizePath() in sftpserver/helper.go. helper.go uses a raw string-prefix comparison, not a directory-boundary check. Because of that, if the configured root is /tmp/goshsroot, then a sibling path such as /tmp/goshsroot_evil/secret.txt incorrectly passes validation since it starts with the same byte prefix. This vulnerability is fixed in 2.0.0-beta.6.

Deeper analysisAI

goshs, a SimpleHTTPServer written in Go, is affected by CVE-2026-40876 prior to version 2.0.0-beta.6. The vulnerability is an SFTP root escape stemming from flawed prefix-based path validation in the sanitizePath() function within sftpserver/helper.go. This function performs a raw string-prefix comparison rather than a proper directory-boundary check, allowing paths like /tmp/goshsroot_evil/secret.txt to pass validation when the configured SFTP root is /tmp/goshsroot. SFTP requests are routed through sftpserver/sftpserver.go into DefaultHandler.GetHandler() in sftpserver/handler.go, which forwards operations to sinks like readFile, writeFile, listFile, and cmdFile that all rely on the vulnerable sanitizePath(). The issue is classified as CWE-22 (Path Traversal) with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

An authenticated SFTP user can exploit this vulnerability over the network with low complexity and no user interaction. By crafting paths that share a prefix with the configured root but reside outside it, the attacker can perform arbitrary read and write operations on the filesystem, breaking the intended jail boundary and potentially exposing or modifying unrelated server files.

The vulnerability is addressed in goshs version 2.0.0-beta.6. Security advisories recommend updating to this version or later to mitigate the issue. Further details are provided in the GitHub security advisory at https://github.com/patrickhener/goshs/security/advisories/GHSA-5h6h-7rc9-3824.