CVE-2026-50138

HighCVSS 8.1

Published: 18/08/2026(UTC)Updated: 19/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

goshs, a simple HTTP server written in Go, does not enforce mode-restriction flags (--read-only, --upload-only, --no-delete) on the WebDAV port when WebDAV is enabled (-w). An authenticated WebDAV client can perform PUT, DELETE, MKCOL, MOVE, and COPY operations despite the operator's intent. The issue is fixed in version 2.1.0.

Risk Assessment

Operators may unknowingly allow modification or deletion of files via WebDAV, potentially leading to unauthorized changes or data loss.

Recommendation

Upgrade goshs to version 2.1.0 or later to ensure consistent enforcement of restrictions on all ports.

Original NVD description (English source)

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is wired straight to `golang.org/x/net/webdav.Handler` with no equivalent guard, so an authenticated WebDAV client can `PUT`, `DELETE`, `MKCOL`, `MOVE`, and `COPY` despite the operator's stated intent. Version 2.1.0 patches the issue.