In goshs versions <= 2.0.9, when the WebDAV listener is enabled, the mode flags --read-only, --upload-only, and --no-delete are not enforced on the WebDAV port. The WebDAV handler is directly wired to golang.org/x/net/webdav.Handler without checks for these flags, unlike the primary HTTP mux which enforces them on state-changing routes. This allows authenticated WebDAV clients to PUT, DELETE, MKCOL, MOVE, and COPY files regardless of the intended restrictions, effectively bypassing the operator's access control settings.

The integrity of files is compromised because the --read-only and --no-delete flags are effectively disabled on the WebDAV port, allowing overwrites and deletions. Confidentiality is also impacted since --upload-only is bypassed, permitting file reads via WebDAV GET and PROPFIND methods. Operators relying on these flags to protect directories from modification or deletion are misled, resulting in trust violations and potential data loss or unauthorized changes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The suggested fix involves adding an HTTP handler in front of the WebDAV handler to enforce the mode flags on WebDAV verbs. Until an official fix is released, operators should avoid enabling the WebDAV listener with these mode flags or restrict access to the WebDAV port to trusted clients only.