# CVE-2026-64863: goshs WebDAV deletion bypass via MOVE and COPY methods

Source: https://junglewise.ai/threats/cve-2026-64863-goshs-webdav-deletion-bypass-via-move-and-copy-methods  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-64863 · Severity: critical · CVSS 9.1 · Published 2026-07-28

goshs is a file server used by developers and security professionals to share files. A security flaw allows users to bypass the "no-delete" safety setting by using specific WebDAV commands. This means an attacker could delete or overwrite important files on the server even when the administrator has explicitly disabled file deletion, leading to data loss or service disruption.

Technologies: [github.com/patrickhener/goshs (Go)](https://junglewise.ai/threats/technologies/github-com-patrickhener-goshs), [github.com/patrickhener/goshs/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-patrickhener-goshs-v2), [goshs.de/goshs (Go)](https://junglewise.ai/threats/technologies/goshs-de-goshs), [goshs.de/goshs/v2 (Go)](https://junglewise.ai/threats/technologies/goshs-de-goshs-v2). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-64863 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64863 being exploited in the wild.

**How severe is CVE-2026-64863?** Critical severity, with a CVSS score of 9.1, published 28 July 2026.

**Which products and versions are affected?** github.com/patrickhener/goshs (Go) <= 1.1.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.4; github.com/patrickhener/goshs/v2 (Go) <= 2.1.3, SEMVER:introduced=0,fixed=2.1.4; goshs.de/goshs (Go) <= 1.1.4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1.4; goshs.de/goshs/v2 (Go) <= 2.1.3, SEMVER:introduced=0,fixed=2.1.4.

**Is there a fix for CVE-2026-64863?** Yes. github.com/patrickhener/goshs/v2 (Go): upgrade to 2.1.4 or later; goshs.de/goshs/v2 (Go): upgrade to 2.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-64863 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-64863?** Check whether you run github.com/patrickhener/goshs (Go), github.com/patrickhener/goshs/v2 (Go), goshs.de/goshs (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/patrickhener/goshs/v2 (Go): upgrade to 2.1.4 or later

  ```sh
  go get github.com/patrickhener/goshs/v2@v2.1.4
  ```

- goshs.de/goshs/v2 (Go): upgrade to 2.1.4 or later

  ```sh
  go get goshs.de/goshs/v2@v2.1.4
  ```


## Technical details

A vulnerability in the WebDAV implementation of goshs exists within the 'wdGuard' handler in 'httpserver/server.go'. While the server correctly blocks the DELETE method when the '--no-delete' flag is set, it incorrectly classifies the MOVE and COPY methods as write-only operations. Because a MOVE operation involves a rename (which deletes the source file) and can include an 'Overwrite: T' header (which deletes the destination file), attackers can bypass deletion restrictions. Similarly, a COPY operation with an overwrite header can destroy existing destination files. This allows unauthenticated network attackers to perform unauthorized file deletions and overwrites. The issue is resolved in version 2.1.4.

## Affected products

- goshs-labs goshs < 2.1.4

## Identifiers

- CVE-2026-64863
- GHSA-hq33-8jgp-8qq3
- GO-2026-6136

## Timeline

- 2026-07-03: patched: Version 2.1.4 released to fix the bypass.
- 2026-07-28: disclosed: CVE-2026-64863 published.

## References

- [https://github.com/goshs-labs/goshs/commit/0444ac6b1a8176ddae70d940adf7a26b2e5a6c29](https://github.com/goshs-labs/goshs/commit/0444ac6b1a8176ddae70d940adf7a26b2e5a6c29)
- [https://github.com/goshs-labs/goshs/releases/tag/v2.1.4](https://github.com/goshs-labs/goshs/releases/tag/v2.1.4)
- [https://github.com/goshs-labs/goshs/security/advisories/GHSA-hq33-8jgp-8qq3](https://github.com/goshs-labs/goshs/security/advisories/GHSA-hq33-8jgp-8qq3)

## Related threats

- [patrickhener goshs race condition in share-link download limit](https://junglewise.ai/threats/cve-2026-50139-patrickhener-goshs-race-condition-in-share-link-download-limit)
- [patrickhener goshs access control bypass in WebDAV listener](https://junglewise.ai/threats/cve-2026-50138-patrickhener-goshs-access-control-bypass-in-webdav-listener)
- [goshs-labs goshs ACL bypass via trailing slash in sendFile handler](https://junglewise.ai/threats/cve-2026-66064-goshs-labs-goshs-acl-bypass-via-trailing-slash-in-sendfile)
- [goshs path traversal in multipart upload handler](https://junglewise.ai/threats/cve-2026-66063-goshs-path-traversal-in-multipart-upload-handler)
- [goshs SFTP authentication bypass via empty password handler logic](https://junglewise.ai/threats/cve-2026-62325-goshs-sftp-authentication-bypass-via-empty-password-handler-logic)