Patrickhener - CraftedSignal Threat Feed

Goshs WebDAV MOVE Method Bypasses No-Delete Flag

hello@craftedsignal.io — Tue, 28 Jul 2026 22:04:16 +0000

A critical vulnerability, tracked as CVE-2026-64863, has been discovered in the goshs WebDAV server (versions up to 2.1.3 and 1.1.4). The --no-delete command-line flag, intended to prevent file deletion and overwriting, is ineffective against the WebDAV MOVE HTTP method. This logical flaw allows a remote attacker to bypass a configured security control, enabling unauthorized deletion of source files or overwriting of existing destination files, even when the server operator believes deletion is disabled. The issue stems from the server's wdGuard handler, which incorrectly classifies MOVE as a write-only operation, thus failing to apply the fs.NoDelete check to it. This oversight defeats the security intent of the --no-delete flag, jeopardizing data integrity for systems using goshs to serve files with deletion restrictions.

Attack Chain

An attacker identifies a goshs server running with WebDAV enabled and the --no-delete flag configured (e.g., goshs --webdav --no-delete).
The attacker attempts to DELETE a file, which is correctly blocked by the server, returning an HTTP 403 Forbidden status, confirming the --no-delete flag is active for the DELETE verb.
The attacker crafts an HTTP MOVE request targeting a sensitive file (e.g., /secret.txt) with a Destination header pointing to a new path (e.g., /gone.txt).
The server processes the MOVE request, effectively deleting /secret.txt from its original location and moving its content to /gone.txt, bypassing the --no-delete control.
Alternatively, the attacker crafts an HTTP MOVE request with an Overwrite: T header, targeting a source file (e.g., /gone.txt) and a destination path that corresponds to an existing, sensitive file (e.g., /victim.txt).
The server processes this MOVE request, first invoking RemoveAll on the existing /victim.txt and then moving the content of /gone.txt to /victim.txt.
This results in the original content of /victim.txt being destroyed and replaced with the attacker-controlled content, allowing data destruction or overwriting, despite the --no-delete flag.

Impact

The impact of CVE-2026-64863 is significant for goshs deployments where file integrity and prevention of deletion/overwriting are paramount. If an operator sets up goshs with --no-delete to protect critical data, such as archived artifacts or confidential documents, any authenticated (or unauthenticated, if no ACLs are in place) WebDAV client can exploit this flaw. This allows an attacker to rename confidential files away, effectively deleting them from their expected location, or worse, overwrite existing sensitive files with arbitrary content. This directly violates the intended security posture, leading to data loss, data corruption, or the unavailability of critical information, undermining the trust in the configured security controls.

Recommendation

Patch CVE-2026-64863: Update goshs to a patched version immediately. Monitor the official GitHub repository for releases that address this vulnerability.
Deploy the Sigma rule in this brief: Implement the provided Sigma rule into your SIEM to detect suspicious WebDAV MOVE requests, particularly those including the Overwrite: T header.
Enable webserver logging: Ensure comprehensive logging for your goshs instances, including HTTP method, URI, status codes, and request headers (specifically Overwrite). This is crucial for the provided Sigma rule.

Goshs File-Based ACL Authorization Bypass via Bulk Zip Download

hello@craftedsignal.io — Tue, 28 Jul 2026 22:01:08 +0000

A high-severity authorization bypass vulnerability, tracked as CVE-2026-54719, has been identified in goshs (versions <= 1.1.4) and goshs/v2 (versions <= 2.1.0) which allows unauthenticated attackers to read arbitrary files. This flaw is a residual vulnerability from a previous fix (GHSA-wvhv-qcqf-f3cx) which addressed ACL bypasses on state-changing routes but failed to cover the ?bulk zip-download endpoint. The bulkDownload function, invoked by requests containing ?bulk and ?file= parameters, retrieves file contents as a ZIP archive without performing the necessary .goshs ACL checks or honoring per-file block lists. This critical oversight enables any unauthenticated network attacker to bypass folder-level and file-level access controls, leading to unauthorized disclosure of confidential information from files located under the webroot. The vulnerability does not affect write or delete operations, limiting the impact to confidentiality only.

Attack Chain

An unauthenticated attacker identifies a vulnerable goshs instance exposed on the network.
The attacker attempts to access a known protected file directly (e.g., GET /protected/secret.txt), which is correctly denied with a 401 Unauthorized response by the server's standard authorization flow.
The attacker then crafts a malicious HTTP GET request targeting the ?bulk zip-download route, appending the ?file= parameter with the path to the desired protected file (e.g., GET /?bulk&file=/protected/secret.txt).
The goshs server receives this request and routes it to the bulkDownload function, bypassing the normal authorization gates.
The bulkDownload function processes the ?file= parameter, retrieves the content of /protected/secret.txt, and streams it back to the attacker within a ZIP archive.
The attacker extracts the ZIP archive to obtain the contents of the confidential file, completely circumventing the .goshs ACL protections and any per-file block lists.

Impact

Successful exploitation of CVE-2026-54719 leads to unauthorized information disclosure, specifically the confidentiality of any file stored under the goshs webroot that relies solely on .goshs ACLs for protection. While a server-wide basic authentication mechanism (-b flag) would still gate the ?bulk route, deployments relying on per-folder .goshs ACLs are vulnerable. Attackers can exfiltrate sensitive data such as configuration files, user data, or intellectual property without any authentication, posing a significant risk to data privacy and security. The vulnerability does not allow for data modification or deletion.

Recommendation

Deploy the Sigma rule Detects CVE-2026-54719 Exploitation - Goshs bulk download ACL bypass to your SIEM to identify attempts to exploit this vulnerability.
Monitor web server access logs for GET requests to /?bulk containing the file= parameter, as these indicate potential exploitation attempts.
Apply the latest security patches from goshs developers immediately, which should enforce .goshs ACLs within the bulkDownload function or route ?bulk requests through the same authorization gate as normal read paths.
Conduct an audit of other alternate read routes such as ?cbDown within your goshs deployments for similar authorization bypass gaps.