CVE-2026-40188

PoC —

CVSS 3.1

7.7 high

EPSS

<1%p25

Published

Apr 10, 2026 (Apr 10, 2026)

Modified

Jun 17, 2026

Description

goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.

Vendors: goshs
Products: goshs
Weakness: CWE-1314
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.