Skip to content
Threat Feed
Subscribe

Product

Goshs <= 2.1.3

1 brief RSS
critical advisory

Goshs WebDAV MOVE Method Bypasses No-Delete Flag

A critical vulnerability (CVE-2026-64863) in the goshs WebDAV server, affecting versions up to 2.1.3, allows an attacker to bypass the `--no-delete` security flag using the `MOVE` HTTP method, leading to unauthorized deletion of source files or overwriting of existing destination files, impacting data integrity.

goshs <= 2.1.3 +1 webdav vulnerability file-deletion data-destruction server golang
1r 1t