https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 01 Aug 2026 04:42:59 +0000 https://vulnerability.circl.lu/sighting/96d3a40f-866f-457c-84cc-0782d27de800/export {"uuid": "96d3a40f-866f-457c-84cc-0782d27de800", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64863", "type": "seen", "source": "https://gist.github.com/alon710/5949a16fe56601aa95656371bd907946", "content": "# CVE-2026-64863: CVE-2026-64863: WebDAV MOVE Bypass of --no-delete and --upload-only Restrictive Policies in goshs\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-64863\n\n## Summary\nAn access control bypass vulnerability in goshs prior to version 2.1.4 allows unauthenticated remote attackers to bypass security flags intended to prevent file deletion and unauthorized modification. By exploiting the server's incorrect classification of WebDAV MOVE and overwriting COPY methods, attackers can execute arbitrary file deletion and data manipulation on the host system.\n\n## TL;DR\ngoshs fails to enforce --no-delete and --upload-only restrictions on WebDAV MOVE and overwriting COPY requests, enabling unauthenticated remote file deletion and data manipulation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-284\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS Score**: 9.1 (Critical)\n- **EPSS Score**: N/A (Recently Disclosed)\n- **Impact**: High Integrity and Availability Impact (Data Destruction and Modification)\n- **Exploit Status**: Proof-of-Concept Documented\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- goshs (Go Simple HTTP Server) installations utilizing WebDAV and configured with --no-delete or --upload-only flags\n- **goshs**: < 2.1.4 (Fixed in: `2.1.4`)\n\n## Mitigation\n\n- Upgrade to goshs version 2.1.4 or higher immediately.\n- Disable the WebDAV interface by omitting the --webdav command-line flag if file deletion prevention is a critical security requirement.\n- Run the server in strict read-only mode using the --read-only flag if write operations are not required by clients.\n\n**Remediation Steps:**\n1. Identify all deployed instances of the goshs binary across the organization's infrastructure.\n2. Terminate running instances of vulnerable goshs versions (< 2.1.4).\n3. Download the patched binary from the official release page (v2.1.4) or rebuild the application using the patched source code.\n4. Relaunch the server with the updated binary, ensuring that necessary security configurations (such as --no-delete) are active.\n5. Verify the patch's effectiveness by running a test suite or utilizing the provided Nuclei detection template against the updated service.\n\n## References\n\n- [GitHub Security Advisory GHSA-hq33-8jgp-8qq3](https://github.com/goshs-labs/goshs/security/advisories/GHSA-hq33-8jgp-8qq3)\n- [NVD - CVE-2026-64863](https://nvd.nist.gov/vuln/detail/CVE-2026-64863)\n- [CVE.org Record - CVE-2026-64863](https://www.cve.org/CVERecord?id=CVE-2026-64863)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-64863) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T07:31:46.079658Z"} {"uuid": "96d3a40f-866f-457c-84cc-0782d27de800", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64863", "type": "seen", "source": "https://gist.github.com/alon710/5949a16fe56601aa95656371bd907946", "content": "# CVE-2026-64863: CVE-2026-64863: WebDAV MOVE Bypass of --no-delete and --upload-only Restrictive Policies in goshs\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-64863\n\n## Summary\nAn access control bypass vulnerability in goshs prior to version 2.1.4 allows unauthenticated remote attackers to bypass security flags intended to prevent file deletion and unauthorized modification. By exploiting the server's incorrect classification of WebDAV MOVE and overwriting COPY methods, attackers can execute arbitrary file deletion and data manipulation on the host system.\n\n## TL;DR\ngoshs fails to enforce --no-delete and --upload-only restrictions on WebDAV MOVE and overwriting COPY requests, enabling unauthenticated remote file deletion and data manipulation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-284\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS Score**: 9.1 (Critical)\n- **EPSS Score**: N/A (Recently Disclosed)\n- **Impact**: High Integrity and Availability Impact (Data Destruction and Modification)\n- **Exploit Status**: Proof-of-Concept Documented\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- goshs (Go Simple HTTP Server) installations utilizing WebDAV and configured with --no-delete or --upload-only flags\n- **goshs**: < 2.1.4 (Fixed in: `2.1.4`)\n\n## Mitigation\n\n- Upgrade to goshs version 2.1.4 or higher immediately.\n- Disable the WebDAV interface by omitting the --webdav command-line flag if file deletion prevention is a critical security requirement.\n- Run the server in strict read-only mode using the --read-only flag if write operations are not required by clients.\n\n**Remediation Steps:**\n1. Identify all deployed instances of the goshs binary across the organization's infrastructure.\n2. Terminate running instances of vulnerable goshs versions (< 2.1.4).\n3. Download the patched binary from the official release page (v2.1.4) or rebuild the application using the patched source code.\n4. Relaunch the server with the updated binary, ensuring that necessary security configurations (such as --no-delete) are active.\n5. Verify the patch's effectiveness by running a test suite or utilizing the provided Nuclei detection template against the updated service.\n\n## References\n\n- [GitHub Security Advisory GHSA-hq33-8jgp-8qq3](https://github.com/goshs-labs/goshs/security/advisories/GHSA-hq33-8jgp-8qq3)\n- [NVD - CVE-2026-64863](https://nvd.nist.gov/vuln/detail/CVE-2026-64863)\n- [CVE.org Record - CVE-2026-64863](https://www.cve.org/CVERecord?id=CVE-2026-64863)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-64863) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T07:31:46.079658Z"} https://vulnerability.circl.lu/sighting/96d3a40f-866f-457c-84cc-0782d27de800/export Wed, 29 Jul 2026 07:31:46 +0000 https://vulnerability.circl.lu/sighting/8d5c6b08-9dde-496d-bf84-754af394515d/export {"uuid": "8d5c6b08-9dde-496d-bf84-754af394515d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64863", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrqxqxdkjb2a", "content": "CVE-2026-64863 - goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite\nCVE ID : CVE-2026-64863\n \n Published : July 28, 2026, 11:17 p.m. | 3\u00a0hours, 21\u00a0minutes ago\n \n Description : goshs is a feature-rich single-binary file server for red teamers and developers. Pr...", "creation_timestamp": "2026-07-29T03:19:54.290579Z"} {"uuid": "8d5c6b08-9dde-496d-bf84-754af394515d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64863", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrqxqxdkjb2a", "content": "CVE-2026-64863 - goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite\nCVE ID : CVE-2026-64863\n \n Published : July 28, 2026, 11:17 p.m. | 3\u00a0hours, 21\u00a0minutes ago\n \n Description : goshs is a feature-rich single-binary file server for red teamers and developers. Pr...", "creation_timestamp": "2026-07-29T03:19:54.290579Z"} https://vulnerability.circl.lu/sighting/8d5c6b08-9dde-496d-bf84-754af394515d/export Wed, 29 Jul 2026 03:19:54 +0000 https://vulnerability.circl.lu/sighting/7a157fbd-8601-4d37-af4c-f94366c077d1/export {"uuid": "7a157fbd-8601-4d37-af4c-f94366c077d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64863", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mrqrvgz4c72d", "content": "WebDAV Delete Disabled, Reality Disabled Harder\nPANIC 48% | Lag 0.0h | CVE-2026-64863 affects goshs in WebDAV mode, where the MOVE command can still delete or overwrite fi\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-07-29T01:35:06.643737Z"} {"uuid": "7a157fbd-8601-4d37-af4c-f94366c077d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64863", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mrqrvgz4c72d", "content": "WebDAV Delete Disabled, Reality Disabled Harder\nPANIC 48% | Lag 0.0h | CVE-2026-64863 affects goshs in WebDAV mode, where the MOVE command can still delete or overwrite fi\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-07-29T01:35:06.643737Z"} https://vulnerability.circl.lu/sighting/7a157fbd-8601-4d37-af4c-f94366c077d1/export Wed, 29 Jul 2026 01:35:06 +0000 https://vulnerability.circl.lu/sighting/97e76623-7d1c-42ac-aa89-b69f4647d56d/export {"uuid": "97e76623-7d1c-42ac-aa89-b69f4647d56d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-64863", "type": "published-proof-of-concept", "source": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-hq33-8jgp-8qq3", "content": "", "creation_timestamp": "2026-07-29T00:35:05.903052Z"} {"uuid": "97e76623-7d1c-42ac-aa89-b69f4647d56d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-64863", "type": "published-proof-of-concept", "source": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-hq33-8jgp-8qq3", "content": "", "creation_timestamp": "2026-07-29T00:35:05.903052Z"} https://vulnerability.circl.lu/sighting/97e76623-7d1c-42ac-aa89-b69f4647d56d/export Wed, 29 Jul 2026 00:35:05 +0000 https://vulnerability.circl.lu/sighting/1bef2e50-59c0-4359-90d6-9d946c293e32/export {"uuid": "1bef2e50-59c0-4359-90d6-9d946c293e32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64863", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqmmv237e2q", "content": "\ud83d\udd34 CVE-2026-64863 - Critical (9.1)\n\ngoshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4,...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-64863/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-29T00:00:47.276281Z"} {"uuid": "1bef2e50-59c0-4359-90d6-9d946c293e32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64863", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqmmv237e2q", "content": "\ud83d\udd34 CVE-2026-64863 - Critical (9.1)\n\ngoshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4,...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-64863/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-29T00:00:47.276281Z"} https://vulnerability.circl.lu/sighting/1bef2e50-59c0-4359-90d6-9d946c293e32/export Wed, 29 Jul 2026 00:00:47 +0000 https://vulnerability.circl.lu/sighting/e71fce16-93e0-4e92-8f72-9254d6ec8569/export {"uuid": "e71fce16-93e0-4e92-8f72-9254d6ec8569", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64863", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrqm5e554m22", "content": "CVE-2026-64863 - goshs\nA bug in goshs allows files to be deleted or overwritten even when the delete option is disabled. This can happen when using the MOVE command in WebDAV mode. To fix this, update\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#goshs #goshsde #Golang #CVE #infosec", "creation_timestamp": "2026-07-28T23:52:05.351346Z"} {"uuid": "e71fce16-93e0-4e92-8f72-9254d6ec8569", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64863", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrqm5e554m22", "content": "CVE-2026-64863 - goshs\nA bug in goshs allows files to be deleted or overwritten even when the delete option is disabled. This can happen when using the MOVE command in WebDAV mode. To fix this, update\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#goshs #goshsde #Golang #CVE #infosec", "creation_timestamp": "2026-07-28T23:52:05.351346Z"} https://vulnerability.circl.lu/sighting/e71fce16-93e0-4e92-8f72-9254d6ec8569/export Tue, 28 Jul 2026 23:52:05 +0000