https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 08:46:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-290863 EUVD-2026-290863 https://cve.radiocsirt.org/vuln/euvd-2026-290863 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40188 <p>goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.</p> <p>goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40188 https://cve.radiocsirt.org/vuln/ghsa-2943-crp8-38xx <p><strong>Affected:</strong> Go: github.com/patrickhener/goshs</p> <p>### Summary The SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP.</p> <p>### Details</p> <p>Here is the issue: ```go // helper.go:155-215 func cmdFile(root string, r *sftp.Request, ip string, sftpServer *SFTPServer) error { fullPath, err := sanitizePath(r.Filepath, root) // Source: SANITIZED if err != nil { return err } switch r.Method { // ... case &#34;Rename&#34;: err := os.Rename(fullPath, r.Target) // Destination: NOT SANITIZED! ```</p> <p>### PoC</p> <p>To exploit just upload a file on the SFTP and rename it to a file with full path.</p> <p>Currently no key.txt file inside /tmp</p> <p>``` bash $ ls key.txt ls: key.txt: No such file or directory ```</p> <p>Start the SFTP server: ``` bash /tmp/sftp-server $ goshs -sftp -b &#39;user:user&#39; -d . WARNING[2026-04-02 20:00:18] upload-folder mode deactivated due to use of &#39;sftp&#39; mode WARNING[2026-04-02 20:00:18] There is a newer Version (v2.0.0-beta.3) of goshs available. Run --update to update goshs. INFO [2026-04-02 20:00:18] Starting SFTP server on port 0.0.0.0:2022 WARNING[2026-04-02 20:00:18] You are using basic auth without SSL. Your credentials will be transferred in cleartext. Consider using -s, too. INFO [2026-04-02 20:00:18] Using basic auth with user &#39;user&#39; and password &#39;user&#39; INFO [2026-04-02 20:00:18] Download embedded file at: /example.txt?embedded INFO [2026-04-02 20:00:18] Serving on interface lo0 bound to 127.0.0.1:8…</p> <p><strong>Affected:</strong> Go: github.com/patrickhener/goshs</p> <p>### Summary The SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP.</p> <p>### Details</p> <p>Here is the issue: ```go // helper.go:155-215 func cmdFile(root string, r *sftp.Request, ip string, sftpServer *SFTPServer) error { fullPath, err := sanitizePath(r.Filepath, root) // Source: SANITIZED if err != nil { return err } switch r.Method { // ... case &#34;Rename&#34;: err := os.Rename(fullPath, r.Target) // Destination: NOT SANITIZED! ```</p> <p>### PoC</p> <p>To exploit just upload a file on the SFTP and rename it to a file with full path.</p> <p>Currently no key.txt file inside /tmp</p> <p>``` bash $ ls key.txt ls: key.txt: No such file or directory ```</p> <p>Start the SFTP server: ``` bash /tmp/sftp-server $ goshs -sftp -b &#39;user:user&#39; -d . WARNING[2026-04-02 20:00:18] upload-folder mode deactivated due to use of &#39;sftp&#39; mode WARNING[2026-04-02 20:00:18] There is a newer Version (v2.0.0-beta.3) of goshs available. Run --update to update goshs. INFO [2026-04-02 20:00:18] Starting SFTP server on port 0.0.0.0:2022 WARNING[2026-04-02 20:00:18] You are using basic auth without SSL. Your credentials will be transferred in cleartext. Consider using -s, too. INFO [2026-04-02 20:00:18] Using basic auth with user &#39;user&#39; and password &#39;user&#39; INFO [2026-04-02 20:00:18] Download embedded file at: /example.txt?embedded INFO [2026-04-02 20:00:18] Serving on interface lo0 bound to 127.0.0.1:8…</p> https://cve.radiocsirt.org/vuln/ghsa-2943-crp8-38xx https://cve.radiocsirt.org/vuln/opensuse-su-2026:10542-1 <p>goshs-2.0.0-1.1 on GA media</p> <p>goshs-2.0.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10542-1