Detections
Analytics
CVE-2026-55560
critical
Description
[email protected] reports: WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4. WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysql_dav_provider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected _exists_record_by_primary_key, _get_field_by_primary_key, and _get_record_by_primary_key methods are part of a shipped example provider that is not enabled by default. An attacker who can access a share explicitly configured with this non-default provider can inject SQL through a normal GET request; anonymously exposed read shares permit a status-code oracle and extraction of arbitrary data reachable by the configured MySQL account. This issue is fixed in version 4.3.5. The WsgiDAV project reports: When follow_symlinks is false (the default), WsgiDAV is expected to prevent serving content through symbolic links - a request for a symlink returns 403 Forbidden: Symlink support is disabled. However, that guard inspects only the leaf component of the resolved path, and the root-containment check is purely lexical (os.path.abspath, which does not resolve symlinks). As a result, a symlink used as an intermediate directory in the request path is neither blocked by the guard nor caught by the containment check, and the request escapes the configured share root. This allows reading, writing, and deleting files outside the root.