Is CVE-2026-64863 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64863 being exploited in the wild.

How severe is CVE-2026-64863?

Critical severity, with a CVSS score of 9.1, published 28 July 2026.

Which products and versions are affected?

github.com/patrickhener/goshs (Go) <= 1.1.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.4; github.com/patrickhener/goshs/v2 (Go) <= 2.1.3, SEMVER:introduced=0,fixed=2.1.4; goshs.de/goshs (Go) <= 1.1.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.4; goshs.de/goshs/v2 (Go) <= 2.1.3, SEMVER:introduced=0,fixed=2.1.4.

Is there a fix for CVE-2026-64863?

Yes. github.com/patrickhener/goshs/v2 (Go): upgrade to 2.1.4 or later; goshs.de/goshs/v2 (Go): upgrade to 2.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-64863 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-64863?

Check whether you run github.com/patrickhener/goshs (Go), github.com/patrickhener/goshs/v2 (Go), goshs.de/goshs (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64863: goshs WebDAV deletion bypass via MOVE and COPY methods

Q: Is there a fix for CVE-2026-64863?

Yes. github.com/patrickhener/goshs/v2 (Go): upgrade to 2.1.4 or later; goshs.de/goshs/v2 (Go): upgrade to 2.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-64863 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-64863?

Check whether you run github.com/patrickhener/goshs (Go), github.com/patrickhener/goshs/v2 (Go), goshs.de/goshs (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64863 · Severity: critical · CVSS 9.1 · Published 2026-07-28

goshs is a file server used by developers and security professionals to share files. A security flaw allows users to bypass the "no-delete" safety setting by using specific WebDAV commands. This means an attacker could delete or overwrite important files on the server even when the administrator has explicitly disabled file deletion, leading to data loss or service disruption.

Technologies: github.com/patrickhener/goshs (Go), github.com/patrickhener/goshs/v2 (Go), goshs.de/goshs (Go), goshs.de/goshs/v2 (Go). Vendors: Go.

Quick answers

Is CVE-2026-64863 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64863 being exploited in the wild.
How severe is CVE-2026-64863?: Critical severity, with a CVSS score of 9.1, published 28 July 2026.
Which products and versions are affected?: github.com/patrickhener/goshs (Go) <= 1.1.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.4; github.com/patrickhener/goshs/v2 (Go) <= 2.1.3, SEMVER:introduced=0,fixed=2.1.4; goshs.de/goshs (Go) <= 1.1.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.4; goshs.de/goshs/v2 (Go) <= 2.1.3, SEMVER:introduced=0,fixed=2.1.4.
Is there a fix for CVE-2026-64863?: Yes. github.com/patrickhener/goshs/v2 (Go): upgrade to 2.1.4 or later; goshs.de/goshs/v2 (Go): upgrade to 2.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64863 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-64863?: Check whether you run github.com/patrickhener/goshs (Go), github.com/patrickhener/goshs/v2 (Go), goshs.de/goshs (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/patrickhener/goshs/v2 (Go): upgrade to 2.1.4 or later
```
go get github.com/patrickhener/goshs/v2@v2.1.4
```
goshs.de/goshs/v2 (Go): upgrade to 2.1.4 or later
```
go get goshs.de/goshs/v2@v2.1.4
```

Technical details

A vulnerability in the WebDAV implementation of goshs exists within the 'wdGuard' handler in 'httpserver/server.go'. While the server correctly blocks the DELETE method when the '--no-delete' flag is set, it incorrectly classifies the MOVE and COPY methods as write-only operations. Because a MOVE operation involves a rename (which deletes the source file) and can include an 'Overwrite: T' header (which deletes the destination file), attackers can bypass deletion restrictions. Similarly, a COPY operation with an overwrite header can destroy existing destination files. This allows unauthenticated network attackers to perform unauthorized file deletions and overwrites. The issue is resolved in version 2.1.4.

Affected products

goshs-labs goshs < 2.1.4

Identifiers

CVE-2026-64863
GHSA-hq33-8jgp-8qq3
GO-2026-6136

Timeline

2026-07-03: patched: Version 2.1.4 released to fix the bypass.
2026-07-28: disclosed: CVE-2026-64863 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.