CVE-2026-64863
goshs, a single‑binary file server used by developers and red‑teamers, had a flaw that let attackers delete or overwrite files using WebDAV MOVE requests. The bug existed before version 2.1.4 and was fixed in that release.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
goshs file server, any version earlier than 2.1.4, typically used by developers and security teams.
Real-world impact
An attacker who can send WebDAV MOVE requests to the server can delete or replace files on the host, potentially destroying data or inserting malicious content, without needing any authentication.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability requires no authentication or user interaction, yet it allows complete loss of integrity and availability of files, which is a critical impact.
What to do about it
- 011. Upgrade goshs to version 2.1.4 or later.
- 022. Verify the upgrade by checking the version number or running a version command.
- 033. Restart the goshs service to apply the new binary.
NVD-referenced vendor advisory
Timeline
- Jul 28, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.