CVE-2026-64863

CriticalCVSS 9.1

Published: 28/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 29/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

In goshs file server before version 2.1.4, the WebDAV MOVE method handling did not enforce the --no-delete option, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T.

Risk Assessment

An attacker can unauthorizedly delete or overwrite files on the server, leading to data loss or integrity compromise.

Recommendation

Update goshs to version 2.1.4 or later.

Original NVD description (English source)

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.