CVE-2026-50138: goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags

July 1, 2026

When goshs is launched with WebDAV enabled (-w), the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler with no equivalent guard, so an authenticated WebDAV client can PUT, DELETE, MKCOL, MOVE, and COPY despite the operator’s stated intent.

References

github.com/advisories/GHSA-3whc-qvhv-xqjp
github.com/patrickhener/goshs/security/advisories/GHSA-3whc-qvhv-xqjp
nvd.nist.gov/vuln/detail/CVE-2026-50138

Code Behaviors & Features

Detect and mitigate CVE-2026-50138 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →