GHSA-HQ33-8JGP-8QQ3 goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

Summary The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce --no-delete on the WebDAV MOVE verb. MOVE deletes the source file rename removes it from its original path, and with Overwrite: T it additionally performs an explicit RemoveAll on the destination. Under -w...

CVE-2026-64863

Summary: CVE-2026-64863 affects goshs, a single-binary file server. Prior to version 2.1.4, the httpserver/server.go wdGuard treated WebDAV MOVE as a write operation without enforcing --no-delete, allowing WebDAV clients to delete or overwrite files by MOVE with Overwrite: T. This could enable un...

CVE-2026-64863 goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issu...

CVE-2026-64863

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issu...

CVE-2026-35488

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, RecipeBookViewSet and RecipeBookEntryViewSet use CustomIsShared as an alternative permission class, but CustomIsShared.hasobjectpermission returns True for all HTTP methods —...