EUVD-2026-50081
GHSA-hq33-8jgp-8qq3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.
AnalysisAI
Improper enforcement of the --no-delete flag in goshs WebDAV server allows unauthorized file deletion or overwrite. The MOVE handler incorrectly treats the verb as write-only without checking the delete restriction, permitting remote attackers using WebDAV clients to bypass the --no-delete boundary via a MOVE request with Overwrite: T. A public proof-of-concept exists, and the vendor has patched this in version 2.1.4.
Path traversal in goshs file server allows unauthenticated remote attackers to write files outside the served directory
Critical authorization bypass in goshs (Go-based HTTP server) versions prior to 2.0.0-beta.4 allows unauthenticated atta
Remote unauthenticated attackers can leak GitHub workflow tokens from goshs repositories via ArtiPACKED attack. The vuln
Path traversal in patrickhener goshs SFTP rename operation enables authenticated attackers to write files outside the co
goshs SimpleHTTPServer versions prior to 2.0.2 allow arbitrary file write via cross-origin PUT requests due to missing C
A path equivalence bypass in goshs lets attackers retrieve blocked files and the ACL configuration file by appending a t
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today