CVE-2026-55509: Improper Neutralization of Special Elements used in an SQL Command

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysqldavprovider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected existsrecordbyprimarykey, getfieldbyprimaryke...

CVE-2026-48099

A flaw was found in WsgiDAV, a WebDAV server. A remote attacker could exploit this vulnerability by sending a specially crafted WebDAV request path containing encoded parent-directory segments. This could allow the attacker to escape the configured filesystem share root, potentially leading to...

CVE-2026-48099

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4...

CVE-2026-48099

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4...

CVE-2026-48099 WsgiDAV encoded dot segments can escape filesystem share roots

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4...

CVE-2026-48099

CVE-2026-48099 - WsgiDAV directory traversal via encoded dot segments WsgiDAV

inginious (>=0.6.0, <=0.9.2), manabi (>=0.1.0, <=0.4.0) potentially affected by CVE-2026-48099 via wsgidav (>=2.2.4, <=4.3.3)

wsgidav PYPI version =2.2.4, =0.6.0, =0.1.0, =0.4.0 Source cves: CVE-2026-48099 Source advisory: MEND:CVE-2026-48099...

CVE-2026-48099 WsgiDAV encoded dot segments can escape filesystem share roots

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4...

EUVD-2026-58224

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4...

CVE-2026-48099: Improper Limitation of a Pathname to a Restricted Directory

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4...

Fedora 43 : python-wsgidav (2026-3808436c81)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3808436c81 advisory. fixes the following security issues: - CVE-2026-55509 - CVE-2026-55560 Tenable has extracted the preceding description block directly from the Fedor...

Fedora 44 : python-wsgidav (2026-348ad953b4)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-348ad953b4 advisory. fixes the following security issues: - CVE-2026-55509 - CVE-2026-55560 Tenable has extracted the preceding description block directly from the Fedor...

PYSEC-2026-3428 WsgiDAV encoded dot segments can escape filesystem share roots

Impact WsgiDAV 4.3.3 can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. Patches The issue is fixed with version 4.3.4. Preconditions The practical impact depends on the deployment. The deployment...

manabi (>=0.1.0, <=0.4.0) potentially affected by CVE-2026-48099 via wsgidav (3.1.1)

wsgidav PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on wsgidav and may be impacted: - manabi =0.1.0, =0.4.0 Source cves: CVE-2026-48099 Source advisory: OSV:PYSEC-2026-3428...

inginious (>=0.8.9, <=0.9.2) potentially affected by CVE-2026-48099 via wsgidav (4.3.3)

wsgidav PYPI version 4.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on wsgidav and may be impacted: - inginious =0.8.9, =0.9.2 Source cves: CVE-2026-48099 Source advisory: OSV:PYSEC-2026-3428...

WsgiDAV encoded dot segments can escape filesystem share roots

ImpactWsgiDAV 4.3.3 can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. PatchesThe issue is fixed with version 4.3.4. PreconditionsThe practical impact depends on the deployment.The deployment use...

inginious (0.6.0) potentially affected by CVE-2026-48099 via wsgidav (2.2.4)

wsgidav PYPI version 2.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on wsgidav and may be impacted: - inginious 0.6.0 Source cves: CVE-2026-48099 Source advisory: OSV:PYSEC-2026-3428...

PT-2026-60039

Impact WsgiDAV 4.3.3 can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. Patches The issue is fixed with version 4.3.4. Preconditions The practical impact depends on the deployment. The deployment...

inginious (>=0.8.9, <=0.9.2) potentially affected by CVE-2026-48099 via wsgidav (4.3.3)

wsgidav PYPI version 4.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on wsgidav and may be impacted: - inginious =0.8.9, =0.9.2 Source cves: CVE-2026-48099 Source advisory: SNYK:PYTHON-WSGIDAV-17670584...

manabi (>=0.1.0, <=0.4.0) potentially affected by CVE-2026-48099 via wsgidav (3.1.1)

wsgidav PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on wsgidav and may be impacted: - manabi =0.1.0, =0.4.0 Source cves: CVE-2026-48099 Source advisory: OSV:GHSA-WXQ4-CC2Q-338Q...