{"id":"CVE-2026-50138","title":"goshs is a SimpleHTTPServer written in Go","summary":"goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP po…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-284"],"vendor":"goshs","product":"goshs.de/goshs/v2","affected":["goshs.de/goshs/v2 <= 2.0.9"],"patched":["goshs.de/goshs/v2 2.1.0"],"published":"2026-08-18","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50138","references":[{"url":"https://github.com/goshs-labs/goshs/security/advisories/GHSA-3whc-qvhv-xqjp","label":"security-advisories@github.com"},{"url":"https://github.com/goshs-labs/goshs/security/advisories/GHSA-3whc-qvhv-xqjp","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/patrickhener/goshs/security/advisories/GHSA-3whc-qvhv-xqjp"},{"url":"https://github.com/advisories/GHSA-3whc-qvhv-xqjp"}],"tags":["nvd","ghsa","go"],"epss":0.00416,"epssPercentile":0.3557,"ecosystem":"go","ingestedAt":"2026-07-01T22:17:35.212Z","slug":"CVE-2026-50138","body":"## Overview\n\ngoshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is wired straight to `golang.org/x/net/webdav.Handler` with no equivalent guard, so an authenticated WebDAV client can `PUT`, `DELETE`, `MKCOL`, `MOVE`, and `COPY` despite the operator's stated intent. Version 2.1.0 patches the issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-50138)\n\nAffected packages:\n\n- `goshs.de/goshs/v2 <= 2.0.9`\n\nPatched in:\n\n- `goshs.de/goshs/v2 2.1.0`\n\nSource: https://github.com/advisories/GHSA-3whc-qvhv-xqjp","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}