DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-64863: CVE-2026-64863: WebDAV MOVE Bypass of --no-delete and --upload-only Restrictive Policies in goshs

#security #cve #cybersecurity

CVE-2026-64863: WebDAV MOVE Bypass of --no-delete and --upload-only Restrictive Policies in goshs

Vulnerability ID: CVE-2026-64863
CVSS Score: 9.1
Published: 2026-07-28

An access control bypass vulnerability in goshs prior to version 2.1.4 allows unauthenticated remote attackers to bypass security flags intended to prevent file deletion and unauthorized modification. By exploiting the server's incorrect classification of WebDAV MOVE and overwriting COPY methods, attackers can execute arbitrary file deletion and data manipulation on the host system.

TL;DR

goshs fails to enforce --no-delete and --upload-only restrictions on WebDAV MOVE and overwriting COPY requests, enabling unauthenticated remote file deletion and data manipulation.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-284
  • Attack Vector: Network (Unauthenticated)
  • CVSS Score: 9.1 (Critical)
  • EPSS Score: N/A (Recently Disclosed)
  • Impact: High Integrity and Availability Impact (Data Destruction and Modification)
  • Exploit Status: Proof-of-Concept Documented
  • KEV Status: Not Listed

Affected Systems

  • goshs (Go Simple HTTP Server) installations utilizing WebDAV and configured with --no-delete or --upload-only flags
  • goshs: < 2.1.4 (Fixed in: 2.1.4)

Code Analysis

Commit: 0444ac6

Enforce mode flags and the .goshs ACL on WebDAV verbs. Refactor request guard to split up MOVE and COPY logic, checking destination existence for COPY and completely blocking MOVE under delete-prevention modes.

Exploit Details

Mitigation Strategies

  • Upgrade to goshs version 2.1.4 or higher immediately.
  • Disable the WebDAV interface by omitting the --webdav command-line flag if file deletion prevention is a critical security requirement.
  • Run the server in strict read-only mode using the --read-only flag if write operations are not required by clients.

Remediation Steps:

  1. Identify all deployed instances of the goshs binary across the organization's infrastructure.
  2. Terminate running instances of vulnerable goshs versions (< 2.1.4).
  3. Download the patched binary from the official release page (v2.1.4) or rebuild the application using the patched source code.
  4. Relaunch the server with the updated binary, ensuring that necessary security configurations (such as --no-delete) are active.
  5. Verify the patch's effectiveness by running a test suite or utilizing the provided Nuclei detection template against the updated service.

References

Read the full report for CVE-2026-64863 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)