Is CVE-2026-40188 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40188 being exploited in the wild.

How severe is CVE-2026-40188?

High severity, with a CVSS score of 7.7, published 10 April 2026.

Which products and versions are affected?

github.com/patrickhener/goshs (Go) >= 1.0.7, <= 1.1.4, SEMVER:introduced=1.0.7, SEMVER:introduced=1.0.7,last_affected=1.1.4.

Is there a fix for CVE-2026-40188?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40188 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-40188?

Check whether you run github.com/patrickhener/goshs (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40188: patrickhener goshs path traversal in SFTP rename command

Q: Is there a fix for CVE-2026-40188?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-40188 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-40188?

Check whether you run github.com/patrickhener/goshs (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40188 · Severity: high · CVSS 7.7 · Published 2026-04-10

goshs is a tool used to serve files over HTTP and SFTP. A security flaw in its SFTP implementation allows an authenticated user to move or rename files to locations outside of the intended shared folder. This could allow an attacker to overwrite critical system files, such as configuration files or security keys, potentially leading to full system takeover.

Technologies: github.com/patrickhener/goshs (Go). Vendors: Go.

Quick answers

Is CVE-2026-40188 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40188 being exploited in the wild.
How severe is CVE-2026-40188?: High severity, with a CVSS score of 7.7, published 10 April 2026.
Which products and versions are affected?: github.com/patrickhener/goshs (Go) >= 1.0.7, <= 1.1.4, SEMVER:introduced=1.0.7, SEMVER:introduced=1.0.7,last_affected=1.1.4.
Is there a fix for CVE-2026-40188?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40188 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-40188?: Check whether you run github.com/patrickhener/goshs (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in the SFTP 'rename' implementation of goshs. While the source path is correctly sanitized against the root directory, the destination path (r.Target) is passed directly to the os.Rename function without validation. An authenticated attacker can exploit this by uploading a file and then using the SFTP rename command to move that file to an arbitrary location on the host filesystem. This can result in arbitrary file overwrite, which may lead to remote code execution if sensitive files like authorized_keys or system configurations are targeted. The issue is addressed in version 2.0.0-beta.4.

Affected products

patrickhener goshs >= 1.0.7, <= 1.1.4

Identifiers

CVE-2026-40188
GHSA-2943-crp8-38xx
GO-2026-4953

Timeline

2026-04-09: disclosed
2026-04-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.