CVE-2026-48099

HighCVSS 7.1

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. Fixed in version 4.3.4.

Risk Assessment

The risk includes unauthorized access to files outside the configured share, potentially leading to disclosure of sensitive data.

Recommendation

Upgrade WsgiDAV to version 4.3.4 or later.

Original NVD description (English source)

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4.