{"id":"EUVD-2026-60948","enisaUuid":"ebf4ed4e-3321-3147-8b69-229b9622dcfc","description":"goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is wired straight to `golang.org/x/net/webdav.Handler` with no equivalent guard, so an authenticated WebDAV client can `PUT`, `DELETE`, `MKCOL`, `MOVE`, and `COPY` despite the operator\u0027s stated intent. Version 2.1.0 patches the issue.","datePublished":"Aug 18, 2026, 2:59:43 PM","dateUpdated":"Aug 19, 2026, 2:30:24 PM","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/goshs-labs/goshs/security/advisories/GHSA-3whc-qvhv-xqjp\n","aliases":"CVE-2026-50138\nGHSA-3whc-qvhv-xqjp\n","assigner":"GitHub_M","epss":0.38,"enisaIdProduct":[{"id":"a63c4263-8660-31fb-ba60-c8902b5bd627","product":{"name":"goshs","vendor":{"name":"patrickhener"}},"product_version":"\u003c 2.1.0"}],"enisaIdVendor":[{"id":"f9131a23-e7d1-3e42-af38-c45a3abfa22a","vendor":{"name":"patrickhener"}}],"enisaIdVulnerability":[{"id":"217d2524-6da0-3828-88cf-40961877d46e","vulnerability":{"id":"GHSA-3whc-qvhv-xqjp","description":"goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags","datePublished":"Jul 1, 2026, 9:56:40 PM","dateUpdated":"Jul 1, 2026, 9:56:40 PM","baseScore":0.0,"references":"https://github.com/patrickhener/goshs/security/advisories/GHSA-3whc-qvhv-xqjp\nhttps://github.com/patrickhener/goshs\n","enisa_id":"EUVD-2026-60948\n","aliases":"GHSA-3whc-qvhv-xqjp\nCVE-2026-50138\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d61a5ec8-3755-367c-92f5-a626e5440d9e","vulnerability":{"id":"CVE-2026-50138","description":"goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is wired straight to `golang.org/x/net/webdav.Handler` with no equivalent guard, so an authenticated WebDAV client can `PUT`, `DELETE`, `MKCOL`, `MOVE`, and `COPY` despite the operator\u0027s stated intent. Version 2.1.0 patches the issue.","datePublished":"Aug 18, 2026, 2:59:43 PM","dateUpdated":"Aug 19, 2026, 2:30:24 PM","status":"PUBLISHED","baseScore":8.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/goshs-labs/goshs/security/advisories/GHSA-3whc-qvhv-xqjp\n","enisa_id":"EUVD-2026-60948\n","assigner":"GitHub_M","epss":0.38,"dataProcessed":"Nov 5, 2026, 7:15:46 AM","vulnerabilityProduct":[{"id":"6a4dfcad-92d1-39d2-96b5-e7c8add2e637","product":{"name":"goshs","vendor":{"name":"patrickhener"}},"product_version":"\u003c 2.1.0"}],"vulnerabilityVendor":[{"id":"2f8863c3-a72c-3006-97a7-6e15bf11d88a","vendor":{"name":"patrickhener"}}]}}],"enisaIdAdvisory":[]}