{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/goshs--2.1.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["goshs \u003c= 2.1.3","goshs \u003c= 1.1.4"],"_cs_severities":["critical"],"_cs_tags":["webdav","vulnerability","file-deletion","data-destruction","server","golang"],"_cs_type":"advisory","_cs_vendors":["patrickhener"],"content_html":"\u003cp\u003eA critical vulnerability, tracked as CVE-2026-64863, has been discovered in the \u003ccode\u003egoshs\u003c/code\u003e WebDAV server (versions up to 2.1.3 and 1.1.4). The \u003ccode\u003e--no-delete\u003c/code\u003e command-line flag, intended to prevent file deletion and overwriting, is ineffective against the WebDAV \u003ccode\u003eMOVE\u003c/code\u003e HTTP method. This logical flaw allows a remote attacker to bypass a configured security control, enabling unauthorized deletion of source files or overwriting of existing destination files, even when the server operator believes deletion is disabled. The issue stems from the server's \u003ccode\u003ewdGuard\u003c/code\u003e handler, which incorrectly classifies \u003ccode\u003eMOVE\u003c/code\u003e as a write-only operation, thus failing to apply the \u003ccode\u003efs.NoDelete\u003c/code\u003e check to it. This oversight defeats the security intent of the \u003ccode\u003e--no-delete\u003c/code\u003e flag, jeopardizing data integrity for systems using \u003ccode\u003egoshs\u003c/code\u003e to serve files with deletion restrictions.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a \u003ccode\u003egoshs\u003c/code\u003e server running with WebDAV enabled and the \u003ccode\u003e--no-delete\u003c/code\u003e flag configured (e.g., \u003ccode\u003egoshs --webdav --no-delete\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker attempts to \u003ccode\u003eDELETE\u003c/code\u003e a file, which is correctly blocked by the server, returning an HTTP 403 Forbidden status, confirming the \u003ccode\u003e--no-delete\u003c/code\u003e flag is active for the \u003ccode\u003eDELETE\u003c/code\u003e verb.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts an HTTP \u003ccode\u003eMOVE\u003c/code\u003e request targeting a sensitive file (e.g., \u003ccode\u003e/secret.txt\u003c/code\u003e) with a \u003ccode\u003eDestination\u003c/code\u003e header pointing to a new path (e.g., \u003ccode\u003e/gone.txt\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe server processes the \u003ccode\u003eMOVE\u003c/code\u003e request, effectively deleting \u003ccode\u003e/secret.txt\u003c/code\u003e from its original location and moving its content to \u003ccode\u003e/gone.txt\u003c/code\u003e, bypassing the \u003ccode\u003e--no-delete\u003c/code\u003e control.\u003c/li\u003e\n\u003cli\u003eAlternatively, the attacker crafts an HTTP \u003ccode\u003eMOVE\u003c/code\u003e request with an \u003ccode\u003eOverwrite: T\u003c/code\u003e header, targeting a source file (e.g., \u003ccode\u003e/gone.txt\u003c/code\u003e) and a destination path that corresponds to an existing, sensitive file (e.g., \u003ccode\u003e/victim.txt\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe server processes this \u003ccode\u003eMOVE\u003c/code\u003e request, first invoking \u003ccode\u003eRemoveAll\u003c/code\u003e on the existing \u003ccode\u003e/victim.txt\u003c/code\u003e and then moving the content of \u003ccode\u003e/gone.txt\u003c/code\u003e to \u003ccode\u003e/victim.txt\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThis results in the original content of \u003ccode\u003e/victim.txt\u003c/code\u003e being destroyed and replaced with the attacker-controlled content, allowing data destruction or overwriting, despite the \u003ccode\u003e--no-delete\u003c/code\u003e flag.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe impact of CVE-2026-64863 is significant for \u003ccode\u003egoshs\u003c/code\u003e deployments where file integrity and prevention of deletion/overwriting are paramount. If an operator sets up \u003ccode\u003egoshs\u003c/code\u003e with \u003ccode\u003e--no-delete\u003c/code\u003e to protect critical data, such as archived artifacts or confidential documents, any authenticated (or unauthenticated, if no ACLs are in place) WebDAV client can exploit this flaw. This allows an attacker to rename confidential files away, effectively deleting them from their expected location, or worse, overwrite existing sensitive files with arbitrary content. This directly violates the intended security posture, leading to data loss, data corruption, or the unavailability of critical information, undermining the trust in the configured security controls.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch CVE-2026-64863\u003c/strong\u003e: Update \u003ccode\u003egoshs\u003c/code\u003e to a patched version immediately. Monitor the official GitHub repository for releases that address this vulnerability.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDeploy the Sigma rule in this brief\u003c/strong\u003e: Implement the provided Sigma rule into your SIEM to detect suspicious WebDAV \u003ccode\u003eMOVE\u003c/code\u003e requests, particularly those including the \u003ccode\u003eOverwrite: T\u003c/code\u003e header.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eEnable webserver logging\u003c/strong\u003e: Ensure comprehensive logging for your \u003ccode\u003egoshs\u003c/code\u003e instances, including HTTP method, URI, status codes, and request headers (specifically \u003ccode\u003eOverwrite\u003c/code\u003e). This is crucial for the provided Sigma rule.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T22:04:16Z","date_published":"2026-07-28T22:04:16Z","id":"https://feed.craftedsignal.io/briefs/2026-07-goshs-webdav-move-bypass/","summary":"A critical vulnerability (CVE-2026-64863) in the goshs WebDAV server, affecting versions up to 2.1.3, allows an attacker to bypass the `--no-delete` security flag using the `MOVE` HTTP method, leading to unauthorized deletion of source files or overwriting of existing destination files, impacting data integrity.","title":"Goshs WebDAV MOVE Method Bypasses No-Delete Flag","url":"https://feed.craftedsignal.io/briefs/2026-07-goshs-webdav-move-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Goshs \u003c= 2.1.3","version":"https://jsonfeed.org/version/1.1"}