PT-2026-33229 · Goshs · Goshs

Published 2026-04-14 · Updated 2026-04-21 · CVE-2026-40876

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.0.0-beta.6

Description goshs contains an SFTP root escape caused by prefix-based path validation. An authenticated SFTP user can read from and write to filesystem paths outside the configured SFTP root, breaking the intended jail boundary and potentially exposing or modifying unrelated server files. The SFTP subsystem routes requests through sftpserver/sftpserver.go into DefaultHandler.GetHandler() in sftpserver/handler.go, which forwards file operations into readFile, writeFile, listFile, and cmdFile. These functions rely on sanitizePath() in sftpserver/helper.go, which uses a raw string-prefix comparison instead of a directory-boundary check. Consequently, if the configured root is '/tmp/goshsroot', a sibling path such as '/tmp/goshsroot evil/secret.txt' incorrectly passes validation because it starts with the same byte prefix.

Recommendations Update to version 2.0.0-beta.6.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-40876

GHSA-5H6H-7RC9-3824

Affected Products

Goshs

References · 5

• 🔥 https://github.com/patrickhener/goshs/security/advisories/GHSA-5h6h-7rc9-3824 · Exploit
• https://osv.dev/vulnerability/GHSA-5h6h-7rc9-3824 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40876 · Security Note
• https://github.com/patrickhener/goshs · Note
• https://github.com/patrickhener/goshs/releases/tag/v2.0.0 · Note