CVE-2026-50138High· 8.1▾ Twilightgoshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP po…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.4%
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled (-w), the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler with no equivalent guard, so an authenticated WebDAV client can PUT, DELETE, MKCOL, MOVE, and COPY despite the operator's stated intent. Version 2.1.0 patches the issue.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
goshs.de/goshs/v2 <= 2.0.9Patched in:
goshs.de/goshs/v2 2.1.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-64863Critical· 9.1goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite
CVE-2026-66063Medium· 6.5goshs has a Path Traversal issue
CVE-2026-50139Medium· 5.9goshs is a SimpleHTTPServer written in Go
CVE-2026-1609High· 8.1A flaw was found in Keycloak
CVE-2026-20736High· 7.5Gitea does not properly verify repository context when deleting attachments
CVE-2026-20750Critical· 9.1Gitea does not properly validate project ownership in organization project operations