The vulnerability CVE-2026-40188 in patrickhener's goshs (versions >=1.0.7 and <2.0.0-beta.4) is due to insufficient sanitization of the destination path in the SFTP rename command. While the source path is sanitized, the destination path is not, enabling an attacker with privileges to rename files to locations outside the SFTP root directory. This can result in unauthorized file writes and potential integrity violations. The flaw is categorized under CWE-1314 (Missing Write Protection for Parametric Data Values). The issue is resolved in version 2.0.0-beta.4.

An attacker with privileges to use the SFTP rename command can write files outside the designated root directory, potentially overwriting or creating files in unauthorized locations. This compromises file integrity but does not directly impact confidentiality or availability according to the CVSS vector. The vulnerability requires privileges and has a low attack complexity, making it a significant risk in environments where users have SFTP access.

Upgrade goshs to version 2.0.0-beta.4 or later, where the vulnerability is fixed. Since no official patch link or advisory is provided, users should verify the version in use and apply the update accordingly. Patch status is not explicitly confirmed beyond the version fix indication; therefore, check the vendor repository or official sources for the latest remediation guidance.