CVE-2026-55509

HighCVSS 8.8

Published: 28/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 29/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

33th percentile - higher than 33% of all known CVEs

Summary

WsgiDAV before version 4.3.5 includes a sample MySQLBrowserProvider that concatenates record keys from request URLs directly into SQL WHERE clauses. An attacker with access to a share configured with this non-default provider can inject SQL via a normal GET request.

Risk Assessment

Arbitrary data reachable by the configured MySQL account can be extracted, and a status-code oracle may be used, threatening data confidentiality.

Recommendation

Update WsgiDAV to version 4.3.5 which contains the fix.

Other vulnerabilities in WsgiDAV

CVE-2026-48099High
WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. Fixed in version 4.3.4.

Original NVD description (English source)

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysql_dav_provider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected _exists_record_by_primary_key, _get_field_by_primary_key, and _get_record_by_primary_key methods are part of a shipped example provider that is not enabled by default. An attacker who can access a share explicitly configured with this non-default provider can inject SQL through a normal GET request; anonymously exposed read shares permit a status-code oracle and extraction of arbitrary data reachable by the configured MySQL account. This issue is fixed in version 4.3.5.