An authenticated user of the goshs SFTP service can read and write arbitrary files on the server that lie outside the intended – or "jail" – root directory. The flaw arises from prefix-based path validation that accepts any file path that begins with the configured root, even when the path refers to a sibling directory that shares the prefix. This permits disclosure of or modification to files that are unrelated to the SFTP service.

The vulnerability affects the goshs project maintained by patrickhener. Any installation of goshs earlier than version 2.0.0‑beta.6 is vulnerable. The affected component is the SFTP subsystem implemented in sftpserver/sftpserver.go and its handler chain that relies on a helper function for path sanitization.

The issue carries a CVSS score of 8.7, indicating high severity. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid SFTP credentials; the mistake in path handling means an attacker can bypass the jail boundary and access privileged files, potentially leading to data leakage or persistence if the server files contain sensitive data.