CVE-2026-50138
Received Received - Intake

WebDAV File Manipulation in Goshs

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is wired straight to `golang.org/x/net/webdav.Handler` with no equivalent guard, so an authenticated WebDAV client can `PUT`, `DELETE`, `MKCOL`, `MOVE`, and `COPY` despite the operator's stated intent. Version 2.1.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-50138
EUVD
EUVD-2026-60948

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
goshs goshs to 2.0.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects goshs, a simple HTTP server in Go. When WebDAV is enabled, the server's mode restrictions like read-only or no-delete are only enforced on the primary HTTP port. The WebDAV port bypasses these restrictions entirely, allowing authenticated clients to perform unauthorized actions such as deleting, uploading, or modifying files without the operator's intended restrictions.

Detection Guidance

To detect this vulnerability, check if goshs is running with WebDAV enabled (-w) and verify if the mode-restriction flags (--read-only, --upload-only, --no-delete) are not enforced on the WebDAV port. Inspect running goshs processes and their configurations. If WebDAV is enabled without proper restrictions, the system is vulnerable.

Impact Analysis

An attacker with WebDAV access could delete, overwrite, or move files on the server, access sensitive data, or bypass intended restrictions. This could lead to data loss, unauthorized modifications, or exposure of confidential information, especially if the server hosts sensitive files.

Compliance Impact

This vulnerability could lead to unauthorized data access or deletion, violating GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Non-compliance risks include legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade goshs to version 2.1.0 or later to patch the vulnerability. If upgrading is not immediately possible, disable WebDAV by removing the -w flag or restrict access to the WebDAV port via firewall rules. Ensure no sensitive files are exposed on the WebDAV endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50138. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart