WsgiDAV encoded dot segments can escape filesystem share roots

ImpactWsgiDAV 4.3.3 can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. PatchesThe issue is fixed with version 4.3.4. PreconditionsThe practical impact depends on the deployment.The deployment use...

PT-2026-59612

Impact A raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection based collections to expose directories without authentication. The issue manifests when pygeoapi is deployed without a proxy or web front end that would...

PT-2026-60039

Impact WsgiDAV 4.3.3 can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. Patches The issue is fixed with version 4.3.4. Preconditions The practical impact depends on the deployment. The deployment...

pygeoapi 路径遍历漏洞

pygeoapi is a geospatial data API server developed by Geopython. In versions 0.23.0 to 0.23.3 of pygeoapi, there was a path traversal vulnerability. This vulnerability originated from a raw string concatenation vulnerability in the STAC FileSystemProvider plugin, which could lead to the exposure ...