CVE-2026-64863
goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite
CRITICAL 9.1EPSS 0.6%
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.
- Affected
- goshs-labs · goshs
- CVSS v3.1 GITHUB
- 9.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - EPSS
- 0.63% chance of exploitation in the next 30 days, 49th percentile
- Published
- 2026-07-28
- Updated
- 2026-07-29