--no-delete bypass via WebDAV MOVE in goshs (CVE-2026-64863)

The WebDAV mode-flag guard in goshs classifies MOVE as a write-only verb and checks it only against the read-only flag, never against the no-delete flag. As a result, a WebDAV client can delete the source file via MOVE and, when the Overwrite: T header is set, additionally overwrite and remove an existing destination file, defeating the documented "Disable the delete option" boundary enforced by --no-delete. Public POC available. Affected versions: - <=v2.1.3 We recommend updating to: v2.1.4. CVSS 9.1 · our assessment: act_now Reference: https://github.com/goshs-labs/goshs/security/advisories/GHSA-hq33-8jgp-8qq3 Details: https://vuln.today/cve/CVE-2026-64863