CVE-2026-64863: WebDAV MOVE Bypass of --no-delete and --upload-only Restrictive Policies in goshs

goshs (Go Simple HTTP Server) is a single-binary file server widely utilized by security practitioners, development teams, and system administrators. The tool features built-in WebDAV support, allowing clients to perform structured filesystem operations over HTTP. To ensure host protection, the server implements command-line flags such as --no-delete (preventing file destruction) and --upload-only (limiting operations to file creation). These flags are processed internally via a request guard middleware named wdGuard inside the httpserver/server.go file.\n\nThe vulnerability identified as CVE-2026-64863 (and tracked via GHSA-hq33-8jgp-8qq3) exposes a critical architectural flaw in this request guard. The middleware misclassifies WebDAV MOVE and overwriting COPY actions as simple, non-destructive write events, validating them only against read-only boundaries. As a result, when the server is explicitly configured to prevent file deletions, remote attackers can execute these actions to bypass policies and delete, rename, or overwrite arbitrary files within the served directory structure.\n\nThis security bypass entirely invalidates the isolation promises of the --no-delete and --upload-only flags. Because no authentication is required in default configurations, any user with network access to the WebDAV service can interact with the exposed API. This flaw presents a substantial risk of data manipulation and operational disruption, particularly when goshs is deployed to receive forensic artifacts, host temporary diagnostic data, or facilitate structured command-and-control operations during authorized assessments.

The root cause of CVE-2026-64863 lies in the incomplete switch-case logical routing within the wdGuard HTTP handler function in httpserver/server.go. The guard groups incoming HTTP methods into distinct categories to enforce the active configuration flags: fs.ReadOnly, fs.UploadOnly, and fs.NoDelete. In the vulnerable implementation, the WebDAV-specific methods MOVE and COPY are grouped in the same switch block as PUT and MKCOL. This group is evaluated solely against the fs.ReadOnly boolean flag, allowing the request to proceed to the WebDAV engine if the server is not in read-only mode.\n\nThis logical structure ignores the destructive capabilities inherent to WebDAV filesystem modifications. According to the WebDAV specification and its Go implementation (golang.org/x/net/webdav), executing a MOVE command invokes an underlying Rename() operation on the filesystem. A standard rename operation on any POSIX or Windows file system removes the source directory entry after linking it to the destination, which represents a structural deletion of the source file. Because wdGuard does not evaluate MOVE against fs.NoDelete or fs.UploadOnly, the deletion is executed without restriction.\n\nAdditionally, the WebDAV specification allows clients to pass an Overwrite header. When a MOVE or COPY request targets an existing destination file path and contains the header Overwrite: T (which is the default behavior if not explicitly disabled), the WebDAV library executes a recursive RemoveAll() operation on the destination path before performing the transfer. This step constitutes an explicit file deletion. Because wdGuard treats MOVE and COPY as simple write operations, this intermediate deletion phase is completely unmonitored, permitting remote clients to destroy or overwrite any existing resource on the server.

Prior to version 2.1.4, the request guard evaluated methods in a simplified, vulnerable switch block. The following code fragment demonstrates the logic where MOVE and COPY are processed without validation against deletion policies:\n\ngo\n// VULNERABLE CODE PATH\nwdGuard := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n switch r.Method {\n case http.MethodPut, \"MKCOL\", \"MOVE\", \"COPY\":\n if fs.ReadOnly {\n http.Error(w, \"read-only\", http.StatusForbidden)\n return\n }\n case http.MethodDelete:\n if fs.ReadOnly || fs.UploadOnly || fs.NoDelete {\n http.Error(w, \"delete disabled\", http.StatusForbidden)\n return\n }\n case http.MethodGet, http.MethodHead:\n if fs.UploadOnly {\n http.Error(w, \"upload-only\", http.StatusForbidden)\n return\n }\n }\n // ... ACL enforcement and handler execution ...\n})\n\n\nTo remediate this logical flaw, the maintainers decoupled the request guard from the main execution stream in commit 0444ac6b1a8176ddae70d940adf7a26b2e5a6c29, introducing a structured webdavGuard middleware. The revised implementation isolates the MOVE method, ensuring it is blocked whenever deletion-prevention policies are active. It also handles the complex state transitions of the COPY method by checking if the target file exists using a helper function called webdavDestExists.\n\ngo\n// PATCHED CODE PATH\nfunc (fs *FileServer) webdavGuard(next http.Handler) http.HandlerFunc {\n return func(w http.ResponseWriter, r *http.Request) {\n switch r.Method {\n case http.MethodPut, \"MKCOL\":\n if fs.ReadOnly {\n http.Error(w, \"read-only\", http.StatusForbidden)\n return\n }\n case \"COPY\":\n if fs.ReadOnly {\n http.Error(w, \"read-only\", http.StatusForbidden)\n return\n }\n // Block overwriting COPY if deletion is prohibited and destination exists\n if (fs.UploadOnly || fs.NoDelete) && r.Header.Get(\"Overwrite\") != \"F\" && fs.webdavDestExists(r) {\n http.Error(w, \"overwrite disabled\", http.StatusForbidden)\n return\n }\n case \"MOVE\":\n // MOVE is inherently destructive and must be blocked if any security policy is active\n if fs.ReadOnly || fs.UploadOnly || fs.NoDelete {\n http.Error(w, \"move disabled\", http.StatusForbidden)\n return\n }\n case http.MethodDelete:\n if fs.ReadOnly || fs.UploadOnly || fs.NoDelete {\n http.Error(w, \"delete disabled\", http.StatusForbidden)\n return\n }\n // ... Rest of the method checks ...\n }\n }\n}\n\n\nWhile this patch significantly improves the security posture of the application, minor edge cases warrant consideration. For example, the webdavDestExists function utilizes Go's os.Stat(abs) to verify file existence. In POSIX environments, executing os.Stat on a broken symbolic link returns an error indicating the file does not exist, which causes webdavDestExists to return false. Consequently, an overwriting COPY request directed at a broken symlink could bypass the protection, allowing the underlying WebDAV handler to overwrite the link on the host disk. Furthermore, differences in path sanitization and trailing slashes between the guard's parser and the standard library's routing could lead to validation discrepancies in highly specific scenarios.

Exploiting CVE-2026-64863 requires minimal effort and can be executed using any command-line tool or library capable of generating raw WebDAV HTTP requests. The adversary must first identify a running instance of goshs with WebDAV support enabled (--webdav) and configured with deletion-prevention options. \n\nThe attack methodology consists of two primary techniques. The first technique targets the removal of critical files. An attacker can delete a target file (such as database.db) by issuing a MOVE request that targets a non-existent file name in a temporary directory. Because the request guard does not block MOVE actions when the --no-delete flag is active, the server executes the underlying filesystem rename operation. This deletes the original file, effectively bypassing the server's policy restrictions.\n\nmermaid\ngraph LR\n Attacker[\"Attacker Request\"] --> Guard{\"wdGuard Middleware\"}\n Guard -- \"Method: DELETE\" --> DeleteBlock[\"Check fs.NoDelete: Blocked 403\"]\n Guard -- \"Method: MOVE\" --> MoveAllow[\"Check fs.ReadOnly: Allowed\"]\n MoveAllow --> WebdavEngine[\"webdav.Handler Engine\"]\n WebdavEngine --> Rename[\"os.Rename(src, dst)\"]\n Rename --> DeleteSource[\"Source File Deleted (Bypass Successful)\"]\n WebdavEngine -- \"Overwrite: T (Default)\" --> RemoveDst[\"os.RemoveAll(dst)\"]\n RemoveDst --> DeleteDst[\"Destination File Deleted (Bypass Successful)\"]\n\n\nThe second technique enables arbitrary file modification and replacement. To replace a protected application file or configuration asset, the attacker uploads a replacement file elsewhere on the server (which is permitted under write-enabled environments) and issues a MOVE request targeting the target file with the header Overwrite: T. This forces the WebDAV library to call RemoveAll() on the destination path and write the replacement contents. A typical curl sequence demonstrating the deletion of a protected file is structured as follows:\n\nbash\n# Bypass the delete prohibition by moving 'protected_file.txt' to a temporary destination\ncurl -X MOVE \\\n -H \"Destination: http://127.0.0.1:18081/temporary_garbage.txt\" \\\n http://127.0.0.1:18081/protected_file.txt\n\n\nTo overwrite an existing target file (target_configuration.json) with malicious input previously uploaded as payload.txt, the attacker sends the following request:\n\nbash\n# Overwrite the target file utilizing the MOVE verb and the Overwrite header\ncurl -X MOVE \\\n -H \"Destination: http://127.0.0.1:18081/target_configuration.json\" \\\n -H \"Overwrite: T\" \\\n http://127.0.0.1:18081/payload.txt\n

The severity of CVE-2026-64863 is classified as Critical, with an assigned CVSS v3.1 Base Score of 9.1. The impact metric analysis highlights high consequences for both integrity and availability. Because an attacker can delete arbitrary files or overwrite existing files, the security state of the served directory cannot be guaranteed. The confidentiality metric is rated as None because this vulnerability does not directly expose or leak file contents, though information disclosure can be achieved indirectly if an attacker overrides server-side configurations to alter access controls.\n\nThe vulnerability has a significant impact on systems that rely on goshs to maintain reliable, non-volatile storage. In incident response and red-teaming scenarios, files such as forensic images, collected system logs, or exfiltrated data are often uploaded to a temporary goshs instance. By exploiting this vulnerability, an adversary can selectively delete evidence, remove security event logs, or overwrite serving files with malicious payloads, leading to persistent access. This can result in the loss of critical diagnostic data or allow unauthorized users to modify host files, undermining the integrity of forensic investigations.\n\nFrom a systemic perspective, this issue is categorized under CWE-284 (Improper Access Control) and maps to several adversarial techniques within the MITRE ATT&CK framework. Specifically, it aligns with T1565.001 (Stored Data Manipulation) and T1070.004 (Indicator Removal on Host: File Deletion). While there are no reports of active exploitation in the wild or integration into automated exploit frameworks, the low barrier to entry and simple payload structure make this vulnerability an attractive target for attackers seeking to disrupt operations or evade detection.

The primary and most effective remediation strategy is to upgrade all instances of goshs to version 2.1.4 or newer. The update incorporates the revised webdavGuard middleware, which properly enforces security policies across all WebDAV request types. To implement this fix, administrators should download the updated pre-compiled binaries or rebuild the server from the official source repository using Go 1.22 or higher.\n\nIf an immediate upgrade is not feasible, administrators must implement temporary defensive workarounds. If the server is deployed in environments where file deletion prevention is critical, WebDAV functionality should be disabled entirely by removing the --webdav command-line argument. Alternatively, if WebDAV is required but write access is not, the server should be configured with the --read-only flag, which is correctly enforced by all versions of the request guard middleware.\n\nyaml\n# Detection Rule: Nuclei Template for CVE-2026-64863\nid: CVE-2026-64863\ninfo:\n name: goshs --no-delete WebDAV MOVE Access Control Bypass\n author: security-researcher\n severity: critical\n description: Detects if a goshs instance running with safety flags is vulnerable to file manipulation and deletion via WebDAV MOVE requests.\n classification:\n cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\n cvss-score: 9.1\n cwe-id: CWE-284\nhttp:\n - raw:\n - |\n PUT /cve-2026-64863-test.txt HTTP/1.1\n Host: {{Hostname}}\n Content-Length: 4\n\n test\n - |\n DELETE /cve-2026-64863-test.txt HTTP/1.1\n Host: {{Hostname}}\n - |\n MOVE /cve-2026-64863-test.txt HTTP/1.1\n Host: {{Hostname}}\n Destination: {{BaseURL}}/cve-2026-64863-moved.txt\n - |\n DELETE /cve-2026-64863-moved.txt HTTP/1.1\n Host: {{Hostname}}\n req-condition: true\n matchers:\n - type: dsl\n dsl:\n - \"status_code_1 == 201 || status_code_1 == 204\"\n - \"status_code_2 == 403 && contains(body_2, 'delete disabled')\"\n - \"status_code_3 == 201 || status_code_3 == 204\"\n condition: and\n\n\nTo monitor for exploitation attempts in production environments, network security teams should deploy Web Application Firewall (WAF) rules to inspect WebDAV requests. Specifically, rules should flag any HTTP MOVE or COPY requests containing an Overwrite header that are sent to servers configured with deletion-prevention policies. Security teams should also monitor system logs for frequent rename or file movement events, as well as unauthorized file operations originating from the WebDAV daemon's process context.