CVE-2026-40188

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40188
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40188.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40188
Aliases
Downstream
Related
Published
2026-04-10T19:43:45Z
Modified
2026-08-27T04:04:08Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N CVSS Calculator
Summary
goshs is Missing Write Protection for Parametric Data Values
Details

goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1314"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40188.json"
}
References

Affected packages

Git / github.com/goshs-labs/goshs

Affected ranges

Type
GIT
Repo
https://github.com/goshs-labs/goshs
Events
Introduced
a24cf77e24a797737603e0f76d502317ff6b3e06
Fixed
0c316e71c6eb69d75218c4af6e9793cc07cdfaab
Fixed
141c188ce270ffbec087844a50e5e695b7da7744
Fixed
10f291dea17fb795f0008ed64c3ad7ab8c0470de
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:goshs:goshs:*:*:*:*:*:go:*:*",
    "extracted_events": [
        {
            "introduced": "1.0.7"
        },
        {
            "fixed": "2.0.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.1.3
v1.*
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.1.1
v1.1.2
v1.1.4
v2.*
v2.0.0-beta.1
v2.0.0-beta.2
v2.0.0-beta.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40188.json"