goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744 Patch
- https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx Exploit, Vendor Advisory
- https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.7 · goshsNVD modified 2026-10-26 21:10
Affected (CPE criteria) 4
cpe:2.3:a:goshs:goshs:*:*:*:*:*:go:*:*cpe:2.3:a:goshs:goshs:2.0.0:beta1:*:*:*:go:*:*cpe:2.3:a:goshs:goshs:2.0.0:beta2:*:*:*:go:*:*cpe:2.3:a:goshs:goshs:2.0.0:beta3:*:*:*:go:*:*
References 4
- https://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744 Patch
- https://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4 Product, Release Notes
- https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx Exploit, Vendor Advisory
- https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx Exploit, Vendor Advisory