Loading story…
A critical vulnerability tracked as CVE-2026-64863 affects goshs before version 2.1.4, allowing unauthenticated remote attackers to bypass the server’s --no-delete and --upload-only protections through flawed WebDAV request handling. The issue stems from MOVE being treated as a write-only method without properly enforcing deletion restrictions, while COPY operations were also insufficiently constrained. An attacker could use crafted WebDAV requests to move, overwrite, or effectively delete files, including by sending MOVE requests with the Overwrite: T header.
The flaw is classified as CWE-284 and has been rated high to critical severity, with reports citing CVSS 9.1 and a published vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. The vendor fixed the issue in goshs 2.1.4 through commit 0444ac6b1a8176ddae70d940adf7a26b2e5a6c29, adding a dedicated webdavGuard middleware to enforce separate restrictions for MOVE and COPY. Reporting also noted residual edge cases involving broken symbolic links and possible path-normalization discrepancies, underscoring the need for users to upgrade promptly.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-64863 was publicly described as a critical access-control bypass in goshs WebDAV handling that allowed unauthenticated attackers to move, overwrite, or effectively delete files despite --no-delete or --upload-only protections. The disclosure notes the issue affects versions prior to 2.1.4 and includes severity assessments and exploitation details.
The WebDAV access-control bypass affecting goshs versions prior to 2.1.4 was remediated by introducing a dedicated webdavGuard middleware to enforce restrictions for MOVE and COPY operations. The fix is referenced as commit 0444ac6b1a8176ddae70d940adf7a26b2e5a6c29 and was released in goshs 2.1.4.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities, **CVE-2026-35392** and **CVE-2026-35393**, were disclosed in **goshs**, a Go-based SimpleHTTPServer, affecting versions prior to **`2.0.0-beta.3`**. Both issues are classified as **CWE-22 path traversal** flaws that arise from missing pathname sanitization in file upload functionality: **PUT** upload handling in `httpserver/updown.go` and **POST multipart** upload directory processing. The weaknesses could allow remote, unauthenticated attackers to write files outside intended directories. Both CVEs carry the same **CVSS v3** vector, **`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`**, indicating high impact to confidentiality, integrity, and availability. The vulnerabilities were addressed in **`2.0.0-beta.3`**, and related GitHub security advisories were published alongside the fixes. Organizations using goshs for file upload workflows should prioritize upgrading and review exposed instances for unauthorized file placement or tampering.
Jun 29, 2026
Two high-severity vulnerabilities were disclosed in **goshs**, a Go-based SimpleHTTPServer, affecting multiple pre-release and stable versions. `CVE-2026-34581` impacts versions `1.1.0` through before `2.0.0-beta.2` and allows attackers to abuse the Share Token feature to bypass download restrictions. The flaw can expose broader goshs functionality beyond intended file access controls and may lead to **code execution**. The issue is classified as `CWE-288` and was fixed in `2.0.0-beta.2`. A second flaw, `CVE-2026-40903`, affects goshs versions before `2.0.0-beta.6` and is described as an **ArtiPACKED** vulnerability that can leak `GITHUB_TOKEN` values through GitHub Actions workflow artifacts, even when the token does not appear in repository source code. The issue is mapped to `CWE-829` and carries high confidentiality and integrity impact, extending concern from application access control to CI/CD credential exposure. The vendor lists `2.0.0-beta.6` as the fix version, and a GitHub security advisory has been published.
Jun 29, 2026
Gogs disclosed a security advisory for an **arbitrary file deletion** vulnerability in its wiki page update functionality, tracked as `GHSA-jp7c-wj6q-3qf2`. The flaw stems from a **path traversal** issue that can let an attacker manipulate file paths during wiki updates and delete files outside the intended directory, creating a risk to repository integrity and server-side data stored by the self-hosted Git service. A public repository referencing `CVE-2026-24135` later documented the same issue as an arbitrary file deletion bug in Gogs caused by wiki path traversal, indicating that technical details are now publicly accessible. Organizations running Gogs should review exposed wiki features, assess whether untrusted users can modify wiki content, and prioritize vendor guidance and patching to prevent unauthorized deletion of application or system files.
Jul 12, 2026