CVE-2026-64863

Received Received - Intake

WebDAV MOVE File Deletion in goshs

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-64863

Affected Vendors & Products

Vendor	Product	Version / Range
goshs	goshs	to 2.1.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects goshs, a single-binary file server, prior to version 2.1.4. The issue is in the WebDAV MOVE method handling in httpserver/server.go. The wdGuard component treated MOVE as a write-only operation and did not enforce the --no-delete flag. This allowed WebDAV clients to delete or overwrite files by sending a MOVE request with the Overwrite header set to T.

Detection Guidance

To detect this vulnerability, check if you are running goshs versions prior to 2.1.4. Inspect WebDAV MOVE requests for Overwrite: T headers that may allow unauthorized file deletion or overwriting. Monitor for unexpected file modifications or deletions in directories served by goshs.

Impact Analysis

If you are using goshs versions before 2.1.4, an attacker could exploit this vulnerability to delete or overwrite files on your server by sending a specially crafted WebDAV MOVE request. This could lead to data loss, unauthorized modifications, or disruption of services.

Compliance Impact

This vulnerability allows unauthorized file deletion or overwriting via WebDAV MOVE requests, which could lead to data loss or integrity issues. Such risks may violate compliance requirements for GDPR (data integrity and availability) and HIPAA (integrity and availability of protected health information).

Mitigation Strategies

Upgrade goshs to version 2.1.4 or later immediately. Disable WebDAV MOVE functionality if not required. Implement strict access controls and audit file permissions. Monitor for suspicious file operations and restrict unauthorized users from accessing the server.

Hi! I’m here to help you understand CVE-2026-64863. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70