goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.

Affected: Go: github.com/patrickhener/goshs

### Summary The SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP.

### Details

Here is the issue: ```go // helper.go:155-215 func cmdFile(root string, r *sftp.Request, ip string, sftpServer *SFTPServer) error { fullPath, err := sanitizePath(r.Filepath, root) // Source: SANITIZED if err != nil { return err } switch r.Method { // ... case "Rename": err := os.Rename(fullPath, r.Target) // Destination: NOT SANITIZED! ```

### PoC

To exploit just upload a file on the SFTP and rename it to a file with full path.

Currently no key.txt file inside /tmp

``` bash $ ls key.txt ls: key.txt: No such file or directory ```

Start the SFTP server: ``` bash /tmp/sftp-server $ goshs -sftp -b 'user:user' -d . WARNING[2026-04-02 20:00:18] upload-folder mode deactivated due to use of 'sftp' mode WARNING[2026-04-02 20:00:18] There is a newer Version (v2.0.0-beta.3) of goshs available. Run --update to update goshs. INFO [2026-04-02 20:00:18] Starting SFTP server on port 0.0.0.0:2022 WARNING[2026-04-02 20:00:18] You are using basic auth without SSL. Your credentials will be transferred in cleartext. Consider using -s, too. INFO [2026-04-02 20:00:18] Using basic auth with user 'user' and password 'user' INFO [2026-04-02 20:00:18] Download embedded file at: /example.txt?embedded INFO [2026-04-02 20:00:18] Serving on interface lo0 bound to 127.0.0.1:8…

goshs-2.0.0-1.1 on GA media