CVE-2026-40876: fallo de gravedad alta en patrickhener goshs
SFTP root escape via prefix-based path validation in goshs
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.4%
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP root escape caused by prefix-based path validation. An authenticated SFTP user can read from and write to filesystem paths outside the configured SFTP root, which breaks the intended jail boundary and can expose or modify unrelated server files. The SFTP subsystem routes requests through sftpserver/sftpserver.go into DefaultHandler.GetHandler() in sftpserver/handler.go, which forwards file operations into readFile, writeFile, listFile, and cmdFile. All of those sinks rely on sanitizePath() in sftpserver/helper.go. helper.go uses a raw string-prefix comparison, not a directory-boundary check. Because of that, if the configured root is /tmp/goshsroot, then a sibling path such as /tmp/goshsroot_evil/secret.txt incorrectly passes validation since it starts with the same byte prefix. This vulnerability is fixed in 2.0.0-beta.6.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
patrickhener · goshsCVEs relacionadas — patrickhener goshs
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-46816CRITICALgoshs route not protected, allows command executionEPSS 0.8%CVE-2026-35471CRITICALImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshsEPSS 0.7%CVE-2026-35393CRITICALImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart uploadEPSS 0.7%CVE-2026-35392CRITICALgoshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT UploadEPSS 0.7%CVE-2026-40189CRITICALgoshs has a file-based ACL authorization bypass in goshs state-changing routesEPSS 0.6%CVE-2026-40884CRITICALgoshs: Empty-username SFTP password authentication bypass in goshsEPSS 0.5%