CVE-2026-40188 goshs is Missing Write Protection for Parametric Data Values

High 7.7 Published 10 Apr 2026 Updated 13 Apr 2026

An attacker can write files outside the SFTP root directory due to insufficient sanitization of the destination path in the rename command.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-40188?

CVE-2026-40188 is a high-severity path traversal vulnerability in patrickhener goshs, published on 10 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.

Weakness: CWE-1314

Which versions are affected by CVE-2026-40188?

3 open source packages ship an affected version, including github.com/patrickhener/goshs. It affects 1 product.

Package	Affected	Fixed in
`github.com/patrickhener/goshs` Go	From `1.0.7`	None
`github.com/patrickhener/goshs` Go	From `1.0.7` to `1.1.4`	None
`github.com/patrickhener/goshs` Go	From `1.0.7` to `1.1.4`	None

Products include Goshs Goshs.

How do I fix CVE-2026-40188?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-40188 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40188 exists.

Sources

Also known as GHSA-2943-crp8-38xx, GO-2026-4953.