CVE-2026-50138: goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags

July 1, 2026

When goshs is launched with WebDAV enabled (-w), the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler with no equivalent guard, so an authenticated WebDAV client can PUT, DELETE, MKCOL, MOVE, and COPY despite the operator’s stated intent.

References

github.com/advisories/GHSA-3whc-qvhv-xqjp
github.com/patrickhener/goshs/security/advisories/GHSA-3whc-qvhv-xqjp
nvd.nist.gov/vuln/detail/CVE-2026-50138

Code Behaviors & Features

Detect and mitigate CVE-2026-50138 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →