SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-50138

HIGH · CVSS 8.1 EPSS 0.33% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-18 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The vulnerability exists in the goshs SimpleHTTPServer prior to version 2.1.0, where WebDAV functionality allows authenticated clients to perform unrestricted file operations (PUT, DELETE, MKCOL, MOVE, COPY) on the WebDAV port, bypassing intended access controls. This could lead to unauthorized data manipulation or deletion, posing significant risks to data integrity and availability. Organizations using goshs with WebDAV enabled should prioritize upgrading to version 2.1.0 to mitigate this high-severity vulnerability.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-50138
Severity
HIGH
CVSS
8.1
EPSS
0.33%

Original NVD Description

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is wired straight to `golang.org/x/net/webdav.Handler` with no equivalent guard, so an authenticated WebDAV client can `PUT`, `DELETE`, `MKCOL`, `MOVE`, and `COPY` despite the operator's stated intent. Version 2.1.0 patches the issue.