In goshs, a SimpleHTTPServer written in Go, versions before 2.1.0 have a security flaw where the WebDAV listener ignores the mode-restriction flags --read-only, --upload-only, and --no-delete. While these flags are enforced on the primary HTTP port, the WebDAV port directly uses golang.org/x/net/webdav.Handler without equivalent access control. As a result, an authenticated WebDAV client can perform unauthorized operations such as PUT, DELETE, MKCOL, MOVE, and COPY, contrary to the operator's intended restrictions. This vulnerability is tracked as CVE-2026-50138 and is addressed in goshs version 2.1.0.

Authenticated users can bypass intended access restrictions on the WebDAV interface, allowing them to create, modify, move, or delete files and directories despite mode flags that should limit these actions. This leads to unauthorized modification of server content, potentially compromising data integrity and confidentiality. The CVSS score of 8.1 reflects a high severity impact with network attack vector, low attack complexity, and no user interaction required.

Upgrade goshs to version 2.1.0 or later, where this issue is patched. Prior to upgrading, restrict access to the WebDAV port to trusted users only, as the vulnerability requires authentication. No other official mitigations are documented.