CVE-2026-40188: Goshs Path Traversal Vulnerability

CVE-2026-40188 Overview

CVE-2026-40188 is a path traversal vulnerability in goshs, a SimpleHTTPServer written in Go. The vulnerability exists in versions from 1.0.7 to before 2.0.0-beta.4, where the SFTP command rename function sanitizes only the source path and not the destination path. This improper sanitization allows an attacker to write files outside of the intended SFTP root directory, potentially leading to unauthorized file modifications on the target system.

Critical Impact

Authenticated attackers can write arbitrary files outside the SFTP root directory, potentially overwriting critical system files or placing malicious content in sensitive locations.

Affected Products

• goshs versions 1.0.7 through 2.0.0-beta.3
• goshs 2.0.0-beta1
• goshs 2.0.0-beta2
• goshs 2.0.0-beta3

Discovery Timeline

• 2026-04-10 - CVE CVE-2026-40188 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-40188

Vulnerability Analysis

This path traversal vulnerability (CWE-1314: Missing Write Protection for Parametric Data Values) stems from inconsistent input validation in the SFTP rename command handler. While the goshs application correctly sanitizes the source file path to prevent path traversal attacks, it fails to apply the same sanitization to the destination path parameter. This asymmetric validation creates an exploitable condition where an authenticated SFTP user can leverage the rename operation to move files to arbitrary locations on the file system, bypassing the intended SFTP root directory restrictions.

The impact of this vulnerability is significant as it allows authenticated users to write files outside the designated SFTP root, potentially enabling them to overwrite configuration files, place malicious executables in system paths, or modify application data in unauthorized locations.

Root Cause

The root cause is inadequate input validation in the SFTP rename command implementation. The source path undergoes proper sanitization to remove path traversal sequences (such as ../), but the destination path is passed directly to the underlying file system operation without similar sanitization. This oversight allows attackers to construct a destination path containing directory traversal sequences that escape the SFTP root directory.

Attack Vector

The attack requires network access and low-level authentication (valid SFTP credentials). An attacker with legitimate SFTP access can exploit this vulnerability by issuing a rename command with a properly formatted source path and a malicious destination path containing traversal sequences. The command structure allows the attacker to specify a destination like ../../etc/cron.d/malicious which would escape the SFTP root and write to the system cron directory.

The vulnerability can be exploited through standard SFTP client connections where the attacker:

1. Authenticates to the goshs SFTP server with valid credentials
2. Creates or uploads a file within the allowed SFTP root
3. Issues a rename command with a valid source path and a path-traversed destination
4. The file is moved to the attacker-specified location outside the SFTP root

Detection Methods for CVE-2026-40188

Indicators of Compromise

• SFTP rename commands with destination paths containing ../ sequences
• Files appearing in unexpected system locations with modification times corresponding to SFTP session activity
• Log entries showing rename operations with destination paths outside the SFTP root directory
• Unexpected file modifications in system configuration directories during active SFTP sessions

Detection Strategies

• Monitor SFTP server logs for rename operations with suspicious destination path patterns
• Implement file integrity monitoring on critical system directories to detect unauthorized writes
• Deploy SentinelOne behavioral AI to detect anomalous file system operations from SFTP server processes
• Configure alerting for any file writes by the goshs process to locations outside its designated root

Monitoring Recommendations

• Enable verbose logging in goshs to capture all SFTP command operations including full path parameters
• Use SentinelOne Singularity XDR to correlate SFTP activity with file system changes
• Implement real-time monitoring of the goshs process for child processes or unexpected file operations

How to Mitigate CVE-2026-40188

Immediate Actions Required

• Upgrade goshs to version 2.0.0-beta.4 or later immediately
• Review SFTP access logs for any evidence of exploitation attempts using path traversal patterns
• Audit file system integrity, particularly in directories outside the SFTP root that may have been modified
• Restrict SFTP access to only necessary users pending the upgrade

Patch Information

The vulnerability has been fixed in goshs version 2.0.0-beta.4. The fix ensures that both source and destination paths in SFTP rename operations are properly sanitized to prevent path traversal. The security patch can be obtained from the GitHub Release v2.0.0-beta.4. For detailed information about the changes, review the GitHub Commit Change and the GitHub Security Advisory GHSA-2943.

Workarounds

• Disable SFTP functionality entirely if the rename command is not required for operations
• Implement network-level access controls to restrict SFTP connections to trusted IP addresses only
• Use a reverse proxy or firewall to inspect and block SFTP commands containing path traversal sequences
• Run goshs with minimal file system permissions to limit the impact of potential exploitation

# Configuration example: Restrict network access to goshs SFTP service
# Using iptables to limit SFTP access to trusted networks only
iptables -A INPUT -p tcp --dport 8022 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8022 -j DROP