CVE-2026-40188: 
NixOS vulnerability analysis and mitigation

CVE-2026-40188 is a path traversal vulnerability in goshs, a SimpleHTTPServer written in Go, affecting its SFTP rename command. The flaw allows authenticated users to write files outside the designated SFTP root directory by specifying an unsanitized destination path. It affects goshs versions 1.0.7 through 2.0.0-beta.3 (inclusive of beta1, beta2, and beta3). The vulnerability was published on April 10, 2026, and carries a CVSS v3.1 base score of 7.7 (High) (GitHub Advisory).

The root cause is classified as CWE-1314 (Missing Write Protection for Parametric Data Values) and stems from asymmetric input sanitization in sftpserver/helper.go. In the cmdFile function, the source path (r.Filepath) is passed through sanitizePath() to prevent directory traversal, but the destination path (r.Target) in the Rename case is passed directly to os.Rename() without any sanitization. An attacker with valid SFTP credentials can upload a file within the root directory and then issue a rename command specifying an absolute path outside the root (e.g., rename key.txt /tmp/key.txt) to move the file to an arbitrary location on the filesystem. The fix, applied in commit 141c188, adds a sanitizePath() call on r.Target before executing the rename operation (GitHub Advisory, Fix Commit).

Successful exploitation allows an authenticated SFTP user to write arbitrary files to any location on the host filesystem that the goshs process has write access to. This can be leveraged for remote code execution by overwriting sensitive files such as SSH authorized keys, cron jobs, or application configuration files. There is no confidentiality or availability impact directly, but the high integrity impact creates a clear path to full system compromise (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, with concrete step-by-step reproduction instructions demonstrating file write outside the SFTP root on a real goshs deployment. Exploitation requires low privileges (valid SFTP credentials) and no user interaction. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.025% (GitHub Advisory).

1. Reconnaissance: Identify a target running goshs with SFTP mode enabled (default port 2022). Obtain or possess valid SFTP credentials (username/password or key-based auth).
2. Connect via SFTP: Use a standard SFTP client to connect to the goshs SFTP server: sftp -P 2022 user@<target>.
3. Upload a file: Place any file into the SFTP root directory using the put command: sftp> put /local/path/payload.txt — this stores the file within the allowed root.
4. Execute malicious rename: Issue a rename command with an absolute destination path outside the SFTP root: sftp> rename payload.txt /home/targetuser/.ssh/authorized_keys — the destination is not sanitized and the file is moved to the specified location.
5. Achieve objective: Depending on the target path chosen, the attacker can overwrite SSH authorized keys for unauthorized access, replace cron scripts for code execution, or tamper with application configuration files (GitHub Advisory).

• Logs: goshs SFTP log entries showing a [Rename] operation where the destination path is an absolute path outside the configured SFTP root directory (e.g., SFTP: [IP]:PORT - [Rename] - "/sftp-root/file.txt to /tmp/key.txt").
• File System: Unexpected new or modified files in sensitive directories (e.g., /tmp/, /home/*/.ssh/authorized_keys, /etc/cron.d/, /root/.ssh/) with timestamps correlating to SFTP session activity.
• Network: SFTP connections (TCP port 2022 by default) from unexpected source IPs, particularly followed by file upload and rename operations in quick succession.
• Process: Unusual processes spawned shortly after SFTP rename activity, potentially indicating post-exploitation via overwritten cron jobs or SSH key abuse (GitHub Advisory).

Upgrade goshs to version 2.0.0-beta.4 or later, which applies sanitizePath() to the rename destination path, preventing traversal outside the SFTP root (Fix Commit, Release Notes). If immediate upgrading is not possible, restrict SFTP access to fully trusted users only, and monitor the filesystem for unexpected file modifications outside the SFTP root directory. Disabling SFTP mode entirely (omitting the -sftp flag) eliminates the attack surface until patching is feasible.

The vulnerability was reported by security researcher marduc812, who is credited in the official GitHub Security Advisory. The maintainer (patrickhener) responded promptly, releasing the fix in v2.0.0-beta.4 on April 9, 2026, the day before the advisory was published. No significant broader media coverage or notable community debate has been observed beyond standard vulnerability database aggregation (GitHub Advisory, Release Notes).