{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-40188/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-40188"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["goshs"],"_cs_severities":["high"],"_cs_tags":["path-traversal","sftp","cve-2026-40188"],"_cs_type":"advisory","_cs_vendors":["goshs"],"content_html":"\u003cp\u003egoshs is a SimpleHTTPServer written in Go. Versions 1.0.7 to before 2.0.0-beta.4 are vulnerable to a path traversal issue (CVE-2026-40188) within the SFTP rename command. This vulnerability arises because the application only sanitizes the source path during a rename operation, neglecting to sanitize the destination path. This oversight allows authenticated attackers with low privileges to manipulate file paths and potentially write files outside the designated SFTP root directory, leading to unauthorized file creation or modification. The vulnerability is resolved in version 2.0.0-beta.4. This vulnerability poses a risk to systems using vulnerable versions of goshs for file sharing.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains low-privilege access to the goshs server via SSH or other means.\u003c/li\u003e\n\u003cli\u003eAttacker establishes an SFTP session with the vulnerable goshs server.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a file or directory within their authorized SFTP root.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an SFTP rename command where the source is a legitimate file within their SFTP root.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts the destination path of the rename command to include path traversal sequences (e.g., \u0026quot;../\u0026quot;) to move outside of the intended root directory.\u003c/li\u003e\n\u003cli\u003eThe vulnerable goshs server executes the rename command using the attacker-controlled destination path without proper sanitization.\u003c/li\u003e\n\u003cli\u003eThe attacker successfully creates or overwrites files in unauthorized locations on the server's file system.\u003c/li\u003e\n\u003cli\u003eThe attacker may leverage the ability to write arbitrary files to achieve persistence by modifying system configuration files.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows attackers to bypass intended access restrictions and potentially overwrite critical system files, leading to code execution or denial-of-service. The impact is high due to the potential for privilege escalation and system compromise. While the exact number of vulnerable installations is unknown, any organization using goshs versions 1.0.7 to before 2.0.0-beta.4 are potentially at risk. Successful exploitation can lead to unauthorized data modification, or system instability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade goshs to version 2.0.0-beta.4 or later to remediate CVE-2026-40188 as mentioned in the overview.\u003c/li\u003e\n\u003cli\u003eMonitor SFTP logs for rename operations containing path traversal sequences like \u0026quot;../\u0026quot; in the destination path. (Generic Recommendation)\u003c/li\u003e\n\u003cli\u003eImplement file integrity monitoring (FIM) on critical system directories to detect unauthorized file modifications resulting from successful exploitation. (Generic Recommendation)\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2026-04-goshs-path-traversal/","summary":"The goshs SimpleHTTPServer, from version 1.0.7 to before 2.0.0-beta.4, is vulnerable to path traversal (CVE-2026-40188) due to insufficient sanitization of the destination path in the SFTP rename command, potentially allowing attackers with low privileges to write files outside the intended root directory.","title":"goshs SimpleHTTPServer SFTP Rename Path Traversal Vulnerability (CVE-2026-40188)","url":"https://feed.craftedsignal.io/briefs/2026-04-goshs-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-40188","version":"https://jsonfeed.org/version/1.1"}