PT-2026-65624 · Goshs · Goshs

CVE-2026-64863 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.1.4

Description In the WebDAV implementation, the wdGuard function in httpserver/server.go incorrectly classifies the MOVE method as a write-only operation. Consequently, it fails to enforce the --no-delete flag. Because the MOVE operation inherently deletes the source file during renaming and can perform a RemoveAll on the destination file when the Overwrite: T header is used, an attacker can delete or overwrite files even when the delete option is explicitly disabled. This bypasses the intended security boundary designed to prevent file removal.

Recommendations Update goshs to version 2.1.4 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-64863

GHSA-HQ33-8JGP-8QQ3

Affected Products

Goshs

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-64863 · Security Note
• https://osv.dev/vulnerability/GHSA-hq33-8jgp-8qq3 · Vendor Advisory
• https://github.com/goshs-labs/goshs/security/advisories/GHSA-hq33-8jgp-8qq3 · Note
• https://github.com/goshs-labs/goshs/releases/tag/v2.1.4 · Note
• https://github.com/goshs-labs/goshs/commit/0444ac6b1a8176ddae70d940adf7a26b2e5a6c29 · Note
• https://github.com/goshs-labs/goshs · Note