CVE-2026-40876: 
NixOS vulnerability analysis and mitigation

CVE-2026-40876 is an SFTP root escape vulnerability in goshs (a SimpleHTTPServer written in Go) caused by prefix-based path validation. An authenticated SFTP user can read from and write to filesystem paths outside the configured SFTP root directory, breaking the intended jail boundary. It affects all goshs versions up to and including v2.0.0-beta.5, and was disclosed on April 13, 2026, with a fix released in v2.0.0-beta.6. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The vulnerable logic resides in sanitizePath() within sftpserver/helper.go, which uses a raw string-prefix comparison (strings.HasPrefix(cleanPath, sftpRoot)) instead of a proper directory-boundary check. Because of this, if the configured SFTP root is /tmp/goshsroot, a sibling path like /tmp/goshsroot_evil/secret.txt incorrectly passes validation since it shares the same byte prefix. The unsafe path then reaches multiple filesystem sinks: os.Open, os.Create, os.Rename, os.RemoveAll, and os.Mkdir, enabling read, write, rename, and delete operations outside the intended root. Exploitation requires only valid SFTP credentials — no elevated privileges or complex conditions are needed (GitHub Advisory).

A successfully exploited vulnerability allows an authenticated SFTP user to read sensitive files, write or overwrite arbitrary files, create or delete directories, and rename files anywhere on the server filesystem that the goshs process has access to. This breaks the intended jail boundary entirely, potentially exposing credentials, configuration files, or other sensitive data, and enabling an attacker to achieve code execution by writing malicious files to locations such as cron directories or application configuration paths. The confidentiality, integrity, and availability of the host system are all at high risk (GitHub Advisory).

A proof-of-concept (PoC) exploit is publicly available in the GitHub Security Advisory, including detailed step-by-step SFTP commands and a complete bash automation script (gosh_poc1) that reproduces the vulnerability against a real goshs deployment. The exploit requires only low-privilege SFTP credentials and no user interaction. The EPSS score is 0.043% (low probability of widespread exploitation in the near term), and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the time of reporting (GitHub Advisory).

1. Reconnaissance: Identify a target running goshs with SFTP enabled (default port 2222). Obtain valid SFTP credentials or an authorized SSH key for the goshs instance.
2. Identify the configured SFTP root: Determine the configured SFTP root directory (e.g., /tmp/goshsroot) through reconnaissance or prior knowledge of the deployment.
3. Craft a sibling path: Construct a path that shares the same string prefix as the SFTP root but points to a sibling directory outside it (e.g., /tmp/goshsroot_evil/secret.txt when root is /tmp/goshsroot).
4. Connect via SFTP: Connect to the goshs SFTP service using the authorized key: sftp -i /tmp/goshs_client_key -P 2222 -o StrictHostKeyChecking=no foo@<target>
5. Read files outside the root: Issue SFTP get commands targeting the sibling path to exfiltrate files: get /tmp/goshsroot_evil/secret.txt /tmp/stolen.txt
6. Write files outside the root: Use SFTP put or mkdir commands to create or overwrite files in sibling directories: mkdir /tmp/goshsroot_owned then put /tmp/malicious.txt /tmp/goshsroot_owned/malicious.txt
7. Escalate if possible: Write a malicious payload (e.g., a cron job, authorized_keys entry, or web shell) to a location that enables persistent access or code execution on the server (GitHub Advisory).

• Network: SFTP connections (default port 2222) to the goshs server from unexpected source IPs; SFTP sessions accessing paths that do not begin with the configured SFTP root directory.
• File System: Unexpected files created or modified in directories adjacent to (but not inside) the configured SFTP root (e.g., /tmp/goshsroot_evil/, /tmp/goshsroot_owned/); new files in sensitive locations such as cron directories, SSH authorized_keys, or application config paths that were written by the goshs process user.
• Logs: goshs server logs showing SFTP file operations (get, put, mkdir, rename, rm) on paths outside the configured root; absence of "access denied: outside of webroot" errors for sibling paths that should have been blocked.
• Process: Unexpected child processes spawned by the goshs binary following a file write event, particularly if a malicious script was placed in an executable location (GitHub Advisory).

Upgrade goshs to version v2.0.0-beta.6 or later, which fixes the vulnerable strings.HasPrefix() check with a proper directory-boundary validation. As interim mitigations: restrict SFTP access to only fully trusted users; implement network segmentation to limit which hosts can reach the SFTP port (default 2222); and monitor filesystem access patterns for activity outside the intended SFTP root. There is no configuration-only workaround that fully addresses the flaw in affected versions (GitHub Advisory).

The vulnerability was published by the goshs project maintainer (patrickhener) via a GitHub Security Advisory on April 13, 2026, and the fix was released promptly in v2.0.0-beta.6. A technical write-up was published by Infinit Security covering the SFTP root escape mechanics. No significant broader media coverage or notable researcher commentary beyond the advisory and initial aggregator coverage has been identified (GitHub Advisory).