The SFTP rename command in goshs sanitizes only the source file path and leaves the destination path unsanitized. An attacker can provide a destination that resolves outside the configured root directory, allowing creation, modification, or deletion of files beyond the intended area. This capability can compromise the confidentiality, integrity, or availability of the server.

The open‑source SimpleHTTPServer tool called goshs, maintained by Patrick Hener, is affected. Versions from 1.0.7 up to, but not including, 2.0.0‑beta.4 contain the flaw; the issue was addressed in release 2.0.0‑beta.4 and later revisions contain the fix.

The flaw carries a CVSS score of 7.7, indicating a high impact. The EPSS score is below 1 %, suggesting a low likelihood of exploitation in the wild. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The most probable attack path is via the SFTP rename operation, which requires network access to the SFTP service and typically valid authentication credentials. Limiting or monitoring the SFTP interface reduces the potential for abuse.