CVE-2026-64863 PUBLISHED

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

Assigner: GitHub_M
Reserved: 20.07.2026 Published: 28.07.2026 Updated: 29.07.2026

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS Score: 9.1

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	goshs-labs
Product	goshs
Versions	Version < 2.1.4 is affected

References

https://github.com/goshs-labs/goshs/security/advisories/GHSA-hq33-8jgp-8qq3
https://github.com/goshs-labs/goshs/commit/0444ac6b1a8176ddae70d940adf7a26b2e5a6c29
https://github.com/goshs-labs/goshs/releases/tag/v2.1.4

Problem Types

CWE-284: Improper Access Control CWE