https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 17:38:56 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-342306 EUVD-2026-342306 https://cve.radiocsirt.org/vuln/euvd-2026-342306 https://cve.radiocsirt.org/vuln/fkie_cve-2026-64863 <p>goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.</p> <p>goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-64863 https://cve.radiocsirt.org/vuln/ghsa-hq33-8jgp-8qq3 <p><strong>Affected:</strong> Go: goshs.de/goshs/v2, Go: github.com/patrickhener/goshs/v2, Go: goshs.de/goshs, Go: github.com/patrickhener/goshs</p> <p>## Summary</p> <p>The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce `--no-delete` on the WebDAV `MOVE` verb. `MOVE` deletes the source file (rename removes it from its original path), and with `Overwrite: T` it additionally performs an explicit `RemoveAll` on the destination. Under `-w --no-delete`, `DELETE` is correctly blocked (403) but `MOVE` still destroys existing files, defeating the documented &#34;Disable the delete option&#34; boundary.</p> <p>This is a residual of the parent fix: the guard classifies `MOVE`/`COPY` as write-only verbs (blocked only under `--read-only`) and never treats `MOVE` as a delete, so the `--no-delete` branch never covers it.</p> <p>## Affected</p> <p>goshs v2.1.3 (current release, commit `ba00ce3`). The guard was introduced when GHSA-3whc-qvhv-xqjp was fixed and carries the gap forward.</p> <p>## Details</p> <p>`httpserver/server.go`, `wdGuard` (lines 237-254):</p> <p>```go wdGuard := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { switch r.Method { case http.MethodPut, &#34;MKCOL&#34;, &#34;MOVE&#34;, &#34;COPY&#34;: if fs.ReadOnly { http.Error(w, &#34;read-only&#34;, http.StatusForbidden) return } case http.MethodDelete: if fs.ReadOnly || fs.UploadOnly || fs.NoDelete { http.Error(w, &#34;delete disabled&#34;, http.StatusForbidden) return } case http.MethodGet, http.MethodHead: if fs.UploadOnly { http.Error(w, &#34;upload-only&#34;, http.StatusForbidden) return…</p> <p><strong>Affected:</strong> Go: goshs.de/goshs/v2, Go: github.com/patrickhener/goshs/v2, Go: goshs.de/goshs, Go: github.com/patrickhener/goshs</p> <p>## Summary</p> <p>The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce `--no-delete` on the WebDAV `MOVE` verb. `MOVE` deletes the source file (rename removes it from its original path), and with `Overwrite: T` it additionally performs an explicit `RemoveAll` on the destination. Under `-w --no-delete`, `DELETE` is correctly blocked (403) but `MOVE` still destroys existing files, defeating the documented &#34;Disable the delete option&#34; boundary.</p> <p>This is a residual of the parent fix: the guard classifies `MOVE`/`COPY` as write-only verbs (blocked only under `--read-only`) and never treats `MOVE` as a delete, so the `--no-delete` branch never covers it.</p> <p>## Affected</p> <p>goshs v2.1.3 (current release, commit `ba00ce3`). The guard was introduced when GHSA-3whc-qvhv-xqjp was fixed and carries the gap forward.</p> <p>## Details</p> <p>`httpserver/server.go`, `wdGuard` (lines 237-254):</p> <p>```go wdGuard := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { switch r.Method { case http.MethodPut, &#34;MKCOL&#34;, &#34;MOVE&#34;, &#34;COPY&#34;: if fs.ReadOnly { http.Error(w, &#34;read-only&#34;, http.StatusForbidden) return } case http.MethodDelete: if fs.ReadOnly || fs.UploadOnly || fs.NoDelete { http.Error(w, &#34;delete disabled&#34;, http.StatusForbidden) return } case http.MethodGet, http.MethodHead: if fs.UploadOnly { http.Error(w, &#34;upload-only&#34;, http.StatusForbidden) return…</p> https://cve.radiocsirt.org/vuln/ghsa-hq33-8jgp-8qq3