goshs is a lightweight HTTP server written in Go. A flaw exists in versions before 2.1.0 when the WebDAV feature is enabled. The command‑line options intended to restrict file operations (--read-only, --upload-only, --no-delete) are applied only to the primary HTTP port; the dedicated WebDAV port bypasses these safeguards. Consequently, an authenticated WebDAV client can add, modify, or delete files, create directories, and move or copy resources on the server, effectively compromising the server’s file integrity and potentially enabling malicious code deployment. This weakness aligns with the Authorization class of vulnerabilities (CWE‑284).

The vulnerable product is patrickhener’s goshs SimpleHTTPServer. Any installation of goshs prior to version 2.1.0 that operates WebDAV (enabled with the -w flag) is affected. Users running earlier releases should review their deployment to determine whether WebDAV is active and whether the restrictive flags were specified.

The CVSS score of 8.1 indicates high severity, while the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. An attacker must first authenticate to the WebDAV service, which is the inferred attack vector. Once authenticated, the attacker can perform unrestricted file operations on the server, potentially leading to remote code execution if the application serves uploaded files or to significant service disruption. The lack of public exploitation data does not reduce the seriousness of an attacker who could target the WebDAV interface for destructive or disruptive actions.