CVE-2026-64863: goshs File Server Auth Bypass Vulnerability

CVE-2026-64863 Overview

CVE-2026-64863 is an access control vulnerability [CWE-284] in goshs, a single-binary file server used by red teamers and developers. Versions prior to 2.1.4 mishandle the WebDAV MOVE verb in the wdGuard handler within httpserver/server.go. The guard treats MOVE as a write-only method and fails to enforce the --no-delete flag. WebDAV clients can therefore delete or overwrite files by issuing MOVE requests with the Overwrite: T header, bypassing intended restrictions. The issue is fixed in goshs version 2.1.4.

Critical Impact
Unauthenticated network attackers can delete or overwrite files on a goshs WebDAV endpoint even when the operator has enabled --no-delete, breaking file integrity and availability guarantees.

Affected Products

goshs file server, all versions prior to 2.1.4
Deployments exposing the built-in WebDAV endpoint
Configurations relying on the --no-delete flag for integrity enforcement

Discovery Timeline

2026-07-28 - CVE-2026-64863 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-64863

Vulnerability Analysis

The goshs HTTP server wraps its WebDAV handler with a wdGuard middleware that enforces mode flags such as ReadOnly, UploadOnly, and NoDelete on WebDAV verbs. The guard groups PUT, MKCOL, MOVE, and COPY together as write operations, and only checks NoDelete against the DELETE verb. WebDAV MOVE with Overwrite: T, however, is semantically both a write and a delete: it removes the destination resource if it exists and unlinks the source. Because the guard never routes MOVE through the delete-policy branch, a client can effectively delete arbitrary files by moving them over one another, or overwrite protected files by moving attacker-controlled content on top. The vulnerability is exploitable over the network with no authentication and no user interaction.

Root Cause

The root cause is a missing authorization check [CWE-284]. The wdGuard handler enumerates WebDAV methods but assigns MOVE only to the write branch that consults fs.ReadOnly. It never consults fs.NoDelete or fs.UploadOnly for MOVE, even though MOVE implicitly removes the source path and can overwrite destinations.

Attack Vector

An attacker sends a WebDAV MOVE request to the exposed goshs endpoint with Destination pointing at a target path and the header Overwrite: T. The server processes the operation despite the --no-delete policy, deleting the source and, if a file exists at the destination, overwriting it. Repeated requests can destroy arbitrary content served by the instance.

// Vulnerable wdGuard logic (pre-2.1.4) in httpserver/server.go
// Enforce mode flags on WebDAV verbs
wdGuard := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
    switch r.Method {
    case http.MethodPut, "MKCOL", "MOVE", "COPY":
        if fs.ReadOnly {
            http.Error(w, "read-only", http.StatusForbidden)
            return
        }
    case http.MethodDelete:
        if fs.ReadOnly || fs.UploadOnly || fs.NoDelete {
            http.Error(w, "delete disabled", http.StatusForbidden)
            return
        }
    case http.MethodGet, http.MethodHead:
        if fs.UploadOnly {
            http.Error(w, "upload-only", http.StatusForbidden)
            return
        }
    }
    // MOVE with Overwrite: T bypasses the NoDelete check above
}

Source: GitHub Commit 0444ac6

Detection Methods for CVE-2026-64863

Indicators of Compromise

HTTP access logs containing MOVE requests against the goshs WebDAV endpoint with an Overwrite: T header.
Unexpected file deletions or content replacements on the served directory while --no-delete was configured.
WebDAV client user agents (for example davfs2, cadaver, rclone) interacting with a goshs instance that should only serve reads.

Detection Strategies

Inspect reverse-proxy or WAF logs for MOVE and COPY verbs targeting goshs instances and alert when they occur outside expected workflows.
Correlate filesystem change events on the served directory against the goshs process to identify writes that violate the configured policy.
Baseline the WebDAV method distribution for each goshs deployment and flag deviations that introduce MOVE traffic.

Monitoring Recommendations

Enable verbose request logging on goshs and forward logs to a central store for retention and correlation.
Monitor the goshs binary version in your inventory and alert on any instance running a release earlier than 2.1.4.
Track outbound WebDAV traffic from operator workstations that might reach exposed goshs listeners.

How to Mitigate CVE-2026-64863

Immediate Actions Required

Upgrade every goshs deployment to version 2.1.4 or later.
Restrict network exposure of goshs to trusted networks or interfaces until the upgrade is complete.
Audit files served by affected instances for signs of unauthorized deletion or overwrite.

Patch Information

The fix is delivered in goshs v2.1.4. The patched wdGuard routes MOVE and COPY through the delete-policy branch when they can remove or overwrite resources, and enforces --no-delete, --read-only, and --upload-only accordingly. See the GitHub Security Advisory GHSA-hq33-8jgp-8qq3 and the v2.1.4 release notes.

Workarounds

Run goshs with --read-only to block all WebDAV write verbs, including MOVE.
Place goshs behind a reverse proxy that rejects MOVE and COPY methods for the affected paths.
Bind goshs to localhost or an internal interface and access it via authenticated tunneling.

bash

# Example NGINX rule to block WebDAV MOVE/COPY in front of goshs
location / {
    if ($request_method ~ ^(MOVE|COPY)$) {
        return 405;
    }
    proxy_pass http://127.0.0.1:8000;
}