Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-40188 goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is… https://www.cve.org/CVERecord?id=CVE-2026-40188
Post summary
CVE-2026-40188 impacts the goshs SimpleHTTPServer by sanitizing only the source path for SFTP rename operations, indicating a potential security flaw. No exploit, patch, or PoC details are provided.
CVE-2026-40188 Path Traversal in Goshs SFTP Rename Command Versions 1.0.7 to 2.0.0-beta.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40188
Post summary
The text announces a path traversal vulnerability (CVE‑2026‑40188) in specific versions of Goshs SFTP, but provides no PoC, exploit, patch, or active exploitation details.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | goshs | goshs | - | go | - |
| App | goshs | goshs | 2.0.0 | go | - |
| App | goshs | goshs | 2.0.0 | go | - |
| App | goshs | goshs | 2.0.0 | go | - |