CVE-2026-48099 WsgiDAV encoded dot segments can escape filesystem share roots

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4...

CVE-2026-48099

CVE-2026-48099 - WsgiDAV directory traversal via encoded dot segments WsgiDAV

manabi (>=0.1.0, <=0.4.0) potentially affected by CVE-2026-48099 via wsgidav (3.1.1)

wsgidav PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on wsgidav and may be impacted: - manabi =0.1.0, =0.4.0 Source cves: CVE-2026-48099 Source advisory: OSV:PYSEC-2026-3428...

inginious (>=0.8.9, <=0.9.2) potentially affected by CVE-2026-48099 via wsgidav (4.3.3)

wsgidav PYPI version 4.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on wsgidav and may be impacted: - inginious =0.8.9, =0.9.2 Source cves: CVE-2026-48099 Source advisory: OSV:PYSEC-2026-3428...

inginious (>=0.8.9, <=0.9.2) potentially affected by CVE-2026-48099 via wsgidav (4.3.3)

wsgidav PYPI version 4.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on wsgidav and may be impacted: - inginious =0.8.9, =0.9.2 Source cves: CVE-2026-48099 Source advisory: OSV:GHSA-WXQ4-CC2Q-338Q...

inginious (>=0.8.9, <=0.9.2) potentially affected by CVE-2026-48099 via wsgidav (4.3.3)

wsgidav PYPI version 4.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on wsgidav and may be impacted: - inginious =0.8.9, =0.9.2 Source cves: CVE-2026-48099 Source advisory: GHSA-WXQ4-CC2Q-338Q...

Fedora 44 : python-wsgidav (2026-b2212b4742)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b2212b4742 advisory. 4.3.4 / 2026-05-24 - Resolve security advisory CVE-2026-48099 Tenable has extracted the preceding description block directly from the Fedora security advisor...

Fedora 43 : python-wsgidav (2026-7d942b469f)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7d942b469f advisory. 4.3.4 / 2026-05-24 - Resolve security advisory CVE-2026-48099 Tenable has extracted the preceding description block directly from the Fedora security advisor...