goshs 缺少对参数数据值的写保护

goshs（用Go编写的SimpleHTTPServer）中的CVE-2026-40188 允许攻击者在SFTP根目录之外写入文件。这是由于SFTP 'rename' 命令中目标路径的清理不足造成的。从1.0.7到2.0.0-beta.4之前的goshs版本容易受到此问题的影响。攻击者可以利用此漏洞修改关键系统文件或破坏存储在服务器上的数据的完整性。该漏洞在CVSS量表上评为7.7，表明存在重大风险。由于缺乏对目标路径的适当验证，因此可以操纵文件位置，从而为特权升级和拒绝服务攻击打开了大门。

Applications built using the goshs library, particularly those handling user-supplied data or sensitive information, are at risk. This includes Go-based microservices, APIs, and command-line tools that rely on goshs for data processing. Projects using older versions of goshs (1.0.7–>= 1.0.7, < 2.0.0-beta.4) are particularly vulnerable.

• go / binary: Examine goshs library usage within Go applications. Look for instances where data is passed to goshs functions without proper validation.

// Example: Check for suspicious data manipulation
if data.ParamValue != nil && data.ParamValue.Value != nil { 
  // Validate data.ParamValue.Value before using it with goshs 
}

• generic web: Monitor application logs for unusual patterns related to data modification or unexpected behavior after data processing. • generic web: Check for unusual file modifications within the application's data directory, especially if goshs is used to manage configuration files.

1. 2026-04-10Disclosure

   disclosure

1. 已保留2026-04-09
2. 发布日期2026-04-10
3. 修改日期2026-04-13
4. EPSS 更新日期2026-04-18

此漏洞的解决方案是将goshs升级到2.0.0-beta.4或更高版本。此版本修复了SFTP 'rename' 命令中的目标路径清理，防止攻击者在根目录之外写入文件。如果无法立即升级，请考虑实施额外的安全措施，例如将SFTP服务器访问限制为授权用户，并监控服务器是否存在可疑活动。升级是减轻与此漏洞相关的风险的最有效措施。请优先在生产和开发环境中进行升级。