CVE-2026-40188: Goshs: güvenlik açığı

Açıklama (NVD)

goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability is fixed in 2.0.0-beta.4.

Özet bilgiler

Ürün

Goshs Goshs

CVSS v3.1

7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

EPSS

%0,32 (yüzdelik 25)

CWE

CWE-1314

Yama

Mevcut

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• github.com
• github.com
• github.com
• github.com
• CWE-1314