External risk intelligence

goshs WebDAV MOVE allows unauthorized file deletion or overwriting

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-64863

The product is a file server tool designed for hosting and sharing files, which is commonly deployed to be accessible over a network to facilitate file transfers. As a web-based file server, it is frequently exposed as a service endpoint to allow remote access by users or clients, making public or external network reachability a standard part of its operational deployment pattern.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the goshs file server could allow unauthorized users to delete or overwrite files remotely. This issue affects how the server handles WebDAV MOVE commands, potentially leading to data loss or integrity compromise. The primary concern is confirming if this tool is in use within our environment.

Remote file deletion/overwriting possible.
Matters if sensitive files are exposed.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted WebDAV MOVE request to the vulnerable file server. This request, when processed by the `wdGuard` component, could allow the attacker to overwrite or delete files without proper authorization, even if delete operations were intended to be restricted.

Accessible over the network.
WebDAV MOVE request.
Unauthorized file overwrite or deletion.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow unauthorized modification or deletion of files served by goshs through a network request, without requiring any user interaction or prior authentication.

Server files could be overwritten or deleted.
Unauthenticated network requests could trigger file operations.
Data integrity and availability risks exist.

Operational Fix

Recommended remediation, mitigation, and detection steps

The real-world ownership for this vulnerability likely falls to the application owners or platform teams responsible for managing the goshs file server. The first practical step is to identify all instances of goshs within your environment, confirm their network exposure and business criticality, and then locate the specific owner for each deployment to plan remediation.

Application owners and platform teams.
Verify goshs network exposure and criticality.
Plan remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is goshs and how is it used?

goshs is a lightweight, single-binary file server utility frequently utilized by developers and red teamers to quickly host and share files over a network. Because it is designed to be portable and easy to deploy, it serves as a rapid way to provide file access during collaborative projects or testing scenarios.

What does CVE-2026-64863 mean for file security?

This vulnerability relates to CWE-284, which concerns improper access control. In this case, the server fails to properly restrict the WebDAV MOVE command. While intended to move files, the flawed logic allows the command to delete or overwrite existing files even when administrative restrictions, like the --no-delete flag, are supposed to be active.

How can an attacker trigger this vulnerability?

An attacker can trigger this by sending a specifically formatted WebDAV MOVE request to the goshs server. Crucially, the vulnerability relies on the 'Overwrite: T' header to force the modification. Simply browsing the files or using standard GET requests to download content does not trigger this flaw; the server must receive this specific command to perform the unauthorized write or delete operation.

Why should I worry about goshs network access?

According to Halo Surface Signal, goshs is typically intended to be network-accessible to function as a file server, which often results in endpoints being exposed to external or wide-reaching network segments. If your instance is reachable from untrusted networks, the lack of authentication for these file operations makes it a higher priority to review.

How do I secure my goshs deployment?

The most effective way to address this issue is to update to version 2.1.4, which includes the necessary logic to properly enforce file operation restrictions. Before applying the update, verify where goshs is running in your environment and confirm if the service is intentionally exposed to the network, as this will help you prioritize which instances need immediate attention.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.