CVE-2026-50138: goshs WebDAV Auth Bypass Vulnerability

CVE-2026-50138 Overview

CVE-2026-50138 is an access control vulnerability [CWE-284] in goshs, a SimpleHTTPServer written in Go. When operators launch goshs with WebDAV enabled using the -w flag, the mode-restriction flags --read-only, --upload-only, and --no-delete apply only to the primary HTTP port. The WebDAV port connects directly to golang.org/x/net/webdav.Handler without an equivalent guard. An authenticated WebDAV client can execute PUT, DELETE, MKCOL, MOVE, and COPY operations against the operator's stated policy. Version 2.1.0 patches the issue.

Critical Impact
Authenticated WebDAV clients can write, move, and delete files on goshs instances that operators believed were locked down as read-only or upload-only.

Affected Products

goshs versions prior to 2.1.0
goshs deployments launched with the -w (WebDAV) flag
Instances relying on --read-only, --upload-only, or --no-delete for policy enforcement

Discovery Timeline

2026-08-18 - CVE-2026-50138 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-50138

Vulnerability Analysis

The vulnerability stems from inconsistent enforcement of access-control policy between two network listeners in the same process. goshs exposes a primary HTTP interface and, when -w is set, a separate WebDAV interface. The primary HTTP handler wraps requests with checks derived from --read-only, --upload-only, and --no-delete. The WebDAV listener does not.

Authenticated clients that reach the WebDAV port can therefore perform full file-system mutation operations on the served directory. Impact includes overwriting existing files, deleting content, creating directories with MKCOL, and repositioning files with MOVE and COPY. The attacker gains write and delete primitives against data the operator marked as read-only.

Root Cause

The WebDAV port is wired straight to golang.org/x/net/webdav.Handler without a mode-restriction middleware. The restriction logic exists only in the HTTP request path. This is a classic missing-authorization pattern where policy is enforced on one code path but not on a parallel one exposing the same underlying resources.

Attack Vector

An attacker requires valid WebDAV credentials and network reachability to the WebDAV port. Using a standard WebDAV client such as cadaver, davfs2, or curl, the attacker issues PUT, DELETE, MKCOL, MOVE, or COPY requests. The server processes each request through webdav.Handler and mutates the served directory. No memory corruption, no exploit code, and no privilege escalation on the host are required. See the GitHub Security Advisory GHSA-3whc-qvhv-xqjp for the maintainer's technical description.

Detection Methods for CVE-2026-50138

Indicators of Compromise

WebDAV requests using PUT, DELETE, MKCOL, MOVE, or COPY methods against a goshs instance configured as --read-only or --no-delete.
New, modified, or deleted files in a goshs-served directory that do not correspond to any operator action.
Successful HTTP 201, 204, or 207 responses on the WebDAV port for methods that should be denied by policy.

Detection Strategies

Parse goshs access logs for write-class HTTP methods on the WebDAV listener and correlate with configured restriction flags.
Compare running goshs process arguments against expected policy and flag any process below version 2.1.0 launched with -w.
Deploy file integrity monitoring on directories served by goshs to catch out-of-policy mutations.

Monitoring Recommendations

Alert on any PUT, DELETE, MKCOL, MOVE, or COPY request handled by the WebDAV port on hosts running vulnerable goshs versions.
Track authentication events on the WebDAV port and correlate failed and successful logins with subsequent file mutations.
Baseline expected file counts and hashes in served directories and alert on unexpected drift.

How to Mitigate CVE-2026-50138

Immediate Actions Required

Upgrade all goshs deployments to version 2.1.0 or later.
Inventory running processes for goshs invocations that include the -w flag and confirm patched versions.
Rotate any WebDAV credentials that were valid on unpatched instances, especially if the served directory contained sensitive data.
Review served directories for unauthorized additions, deletions, or modifications.

Patch Information

The maintainers fixed the issue in goshs 2.1.0 by extending the mode-restriction enforcement to the WebDAV handler. Refer to the GitHub Security Advisory GHSA-3whc-qvhv-xqjp for release details and commit references.

Workarounds

Disable WebDAV by launching goshs without the -w flag until the upgrade is complete.
Restrict network access to the WebDAV port using a host firewall or network ACL so that only trusted administrators can reach it.
Serve sensitive content from a read-only filesystem mount so that mutation attempts fail at the OS layer regardless of application policy.

bash

# Configuration example: run goshs without WebDAV until patched
goshs -p 8000 --read-only

# Or, if WebDAV is required, upgrade first and confirm the version
goshs --version   # must report >= 2.1.0
goshs -p 8000 -w --read-only