Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_M

CVE-2026-40876SFTP root escape via prefix-based path validation in goshs

High 8.7

In plain English

A high-severity path traversal in goshs from patrickhener. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 61.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP root escape caused by prefix-based path validation. An authenticated SFTP user can read from and write to filesystem paths outside the configured SFTP root, which breaks the intended jail boundary and can expose or modify unrelated server files. The SFTP subsystem routes requests through sftpserver/sftpserver.go into DefaultHandler.GetHandler() in sftpserver/handler.go, which forwards file operations into readFile, writeFile, listFile, and cmdFile. All of those sinks rely on sanitizePath() in sftpserver/helper.go. helper.go uses a raw string-prefix comparison, not a directory-boundary check. Because of that, if the configured root is /tmp/goshsroot, then a sibling path such as /tmp/goshsroot_evil/secret.txt incorrectly passes validation since it starts with the same byte prefix. This vulnerability is fixed in 2.0.0-beta.6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/patrickhener/goshs	no fix listed	GHSA-5h6h-7rc9-3824
Go	github.com/patrickhener/goshs	no fix listed	GO-2026-5146
Go	github.com/patrickhener/goshs/v2	2.0.0	GHSA-5h6h-7rc9-3824
Go	github.com/patrickhener/goshs/v2	2.0.0	GO-2026-5146

Affected products (as reported)

Vendor	Product	Versions
patrickhener	goshs	< 2.0.0-beta.6

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/patrickhener/goshs/security/advisories/GHSA-5h6h-7rc9-3824 x_refsource_CONFIRM