CVE-2026-40876

OVERVIEW CVE-2026-40876 is a path traversal vulnerability affecting goshs, a SimpleHTTPServer implementation written in Go, prior to version 2.0.0-beta.6. An authenticated SFTP user can escape the configured SFTP root directory and access arbitrary filesystem paths on the server due to flawed prefix-based path validation in the sanitizePath function. SEVERITY The vulnerability exploits a fundamental validation flaw where the application uses simple string prefix comparison rather than proper directory boundary checking. This allows attackers to access sibling directories with matching prefixes; for example, configuring root as /tmp/goshsroot does not prevent access to /tmp/goshsroot_evil. The attack requires prior authentication and provides read and write access to unintended files, potentially exposing sensitive data or enabling unauthorized modifications to server files. The FAUCET Risk Score of 42.0/100 indicates moderate severity. EXPLOITATION STATUS This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog, and there is no evidence of active exploitation in the wild. The EPSS score of 0.0004 suggests minimal probability of exploitation in practice. The vulnerability appears to have received limited community attention, though the fix was incorporated into the official 2.0.0-beta.6 release. Organizations running goshs prior to this version should apply the patch to remediate the jail escape condition.