{"id":"EUVD-2026-21589","enisaUuid":"dbd0bc7a-0bf3-3be8-b02e-1406d8cb1a9b","description":"goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.","datePublished":"Apr 10, 2026, 7:43:45 PM","dateUpdated":"Apr 13, 2026, 3:35:32 PM","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","references":"https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx\nhttps://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744\nhttps://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4\n","aliases":"CVE-2026-40188\nGHSA-2943-crp8-38xx\n","assigner":"GitHub_M","epss":0.32,"enisaIdProduct":[{"id":"ab5b33af-f0eb-3180-b6ad-afb422e2a659","product":{"name":"goshs","vendor":{"name":"patrickhener"}},"product_version":"1.0.7, \u003c 2.0.0-beta.4"}],"enisaIdVendor":[{"id":"3e54563c-de24-34f1-9343-fbd8f2c80f84","vendor":{"name":"patrickhener"}}],"enisaIdVulnerability":[{"id":"2e026189-230e-3b62-ba2a-a6ff9d73948d","vulnerability":{"id":"GHSA-2943-crp8-38xx","description":"goshs is Missing Write Protection for Parametric Data Values","datePublished":"Apr 10, 2026, 8:00:28 PM","dateUpdated":"Jun 8, 2026, 8:08:46 PM","baseScore":0.0,"references":"https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40188\nhttps://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744\nhttps://github.com/patrickhener/goshs\nhttps://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4\n","enisa_id":"EUVD-2026-21589\n","aliases":"GHSA-2943-crp8-38xx\nCVE-2026-40188\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"dc0e4b94-2089-3735-b19c-02cb708d3e72","vulnerability":{"id":"CVE-2026-40188","description":"goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.","datePublished":"Apr 10, 2026, 7:43:45 PM","dateUpdated":"Apr 13, 2026, 3:35:32 PM","status":"PUBLISHED","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","references":"https://github.com/patrickhener/goshs/security/advisories/GHSA-2943-crp8-38xx\nhttps://github.com/patrickhener/goshs/commit/141c188ce270ffbec087844a50e5e695b7da7744\nhttps://github.com/patrickhener/goshs/releases/tag/v2.0.0-beta.4\n","enisa_id":"EUVD-2026-21589\n","assigner":"GitHub_M","epss":0.32,"dataProcessed":"Oct 27, 2026, 7:16:42 AM","vulnerabilityProduct":[{"id":"5811ff0e-80d2-3ac7-aba4-bc0b1938b8c4","product":{"name":"goshs","vendor":{"name":"patrickhener"}},"product_version":"1.0.7, \u003c 2.0.0-beta.4"}],"vulnerabilityVendor":[{"id":"3636dee8-a84b-3841-919e-5a59fb4be825","vendor":{"name":"patrickhener"}}]}}],"enisaIdAdvisory":[{"id":"ffe7f8da-79d4-3e7d-84fa-1d4d2c2e0588","advisory":{"id":"openSUSE-SU-2026:10542-1","description":"goshs-2.0.0-1.1 on GA media","summary":"goshs-2.0.0-1.1 on GA media","datePublished":"Apr 14, 2026, 12:00:00 AM","dateUpdated":"Sep 17, 2026, 5:00:59 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10542-1.json\nhttps://www.suse.com/security/cve/CVE-2026-35392/\nhttps://www.suse.com/security/cve/CVE-2026-35393/\nhttps://www.suse.com/security/cve/CVE-2026-35471/\nhttps://www.suse.com/security/cve/CVE-2026-40188/\nhttps://www.suse.com/security/cve/CVE-2026-40189/\n","aliases":"CVE-2026-35392\nCVE-2026-35393\nCVE-2026-35471\nCVE-2026-40188\nCVE-2026-40189\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"12ba212c-95a3-3f44-8a22-605d38a2eb14","product":{"name":"goshs-0:2.0.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"62cda1e6-fa4b-3141-9df0-ddfc5ea29fb8","product":{"name":"goshs-2.0.0-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"64c1a97f-a93d-316b-acd2-a091b137aa06","product":{"name":"goshs-2.0.0-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"680ba8b7-f375-3c37-b9a8-b2d540848fd4","product":{"name":"goshs-2.0.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"6eee01b4-7b33-3d92-87de-1d2318c1c4d6","product":{"name":"goshs-0:2.0.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"8694700f-150b-3439-8dda-487e0bae10cc","product":{"name":"goshs-2.0.0-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"a436d0e8-e0c2-3b0c-ad38-c4177ceee67b","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"ca3ee627-3653-3f38-afa1-4771ec8f1e6f","product":{"name":"goshs-0:2.0.0-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"ce618300-9bad-3e74-8b4f-31b2c4e78d5b","product":{"name":"goshs-0:2.0.0-1.1.ppc64le","vendor":{"name":"SUSE"}}}]}}]}