CVE-2026-64863 goshs-labs CVE debrief

Who should care

Defenders and administrators of goshs installations, especially in environments where unauthorized file modifications could have significant impacts, should prioritize patching or mitigating this vulnerability.

Why it matters

CVE-2026-64863 is a critical vulnerability in goshs that allows unauthorized file modifications via WebDAV MOVE requests. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where unauthorized file modifications could have significant impacts.

• Potential unauthorized file deletion or overwrite
• Possible disruption of file server operations
• Risk of data loss or corruption
• Need for verification of file integrity and access controls

Technical summary

goshs, a single-binary file server, is vulnerable to unauthorized file deletion or overwrite via WebDAV MOVE requests due to improper handling of the --no-delete flag in the httpserver/server.go wdGuard. This issue is fixed in version 2.1.4. The vulnerability allows WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where unauthorized file modifications could have significant impacts. The vulnerability has a CVSS score of 9.1 and is considered critical.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where unauthorized file modifications could have significant impacts.

Recommended defensive actions

• Patch goshs to version 2.1.4 or later
• Restrict WebDAV access to trusted clients and users
• Monitor for suspicious WebDAV activity
• Verify file integrity and access controls
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, additional information about potential exploitation or affected systems is limited. Defenders should verify the integrity of file access controls and monitor for suspicious WebDAV activity. The CVE Program record and NVD detail page offer source-provided CVE metadata and vulnerability assessments. Additional source references provide information on the fix commit, fixed version release, and security advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.