by Kastro
Paper/Archive/CVE-2026-64863

CVE-2026-64863

goshs-labs goshs — goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

EPSS 0.4%public exploitCVSS 9.1
critical.is priorityof 100
45
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 36.6.366 × 207.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.

Affected

ProductAffectedFixed inSource
goshs< 2.1.4–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

exploitgithub.com/goshs-labs/goshs/security/advisories/GHSA-hq33-8jgp-8qq3refgithub.com/goshs-labs/goshs/commit/0444ac6b1a8176ddae70d940adf7a26b2e5a6c29refgithub.com/goshs-labs/goshs/releases/tag/v2.1.4