CVE-2026-50138— goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
Possible ATT&CK Techniques 1AI
T1565.001 · Stored Data ManipulationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| patrickhener | goshs | < 2.1.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-50138
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
Source: CVE Program / CVE List V5
Vulnerability Description
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is wired straight to `golang.org/x/net/webdav.Handler` with no equivalent guard, so an authenticated WebDAV client can `PUT`, `DELETE`, `MKCOL`, `MOVE`, and `COPY` despite the operator's stated intent. Version 2.1.0 patches the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
goshs-labs goshs 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
goshs-labs goshs是goshs-labs组织的一个Web服务器软件。 goshs-labs goshs 2.1.0之前版本存在权限许可和访问控制问题漏洞，该漏洞源于WebDAV端口未正确执行模式限制标志，可能导致已认证的WebDAV客户端绕过限制执行PUT、DELETE、MKCOL、MOVE和COPY等操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| patrickhener | goshs | < 2.1.0 | - |
II. Public POCs for CVE-2026-50138
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 8781 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-50138
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-50138 (1)
IV. Related Vulnerabilities
Same product: goshs
- CVE-2026-50139
goshs: Share-link ?token=… redemption races past download li - CVE-2026-66064
goshs has ACL Bypass & Path Traversal - CVE-2026-66063
goshs has a Path Traversal issue - CVE-2026-64863
goshs --no-delete WebDAV MOVE bypass allows file deletion/ov - CVE-2026-54719
goshs: File-based .goshs ACL authorization bypass via the ?b
Same vendor: patrickhener
- CVE-2026-50139
goshs: Share-link ?token=… redemption races past download li - CVE-2026-42091
goshs has Cross-Origin Arbitrary File Write via Missing CSRF - CVE-2026-40903
Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential - CVE-2026-40885
goshs: Public collaborator feed leaks .goshs ACL credentials - CVE-2026-40884
goshs: Empty-username SFTP password authentication bypass in
Same weakness: CWE-284
- CVE-2026-55622
Incus has a project restriction bypass in instance copy acro - CVE-2026-55621
Incus has a project restriction bypass for custom volume cop - CVE-2026-62440
Apache CloudStack: Improper access control in Kubernetes Ser - CVE-2026-66797
Apache CloudStack: Unauthorised comment creation and disclos - CVE-2026-66309
Azure SQL Database Elevation of Privilege Vulnerability
V. Comments for CVE-2026-50138
No comments yet