Detections
Analytics
FreeBSD : py-WsgiDAV -- Multiple vulnerabilities (0f5aaca7-c4d5-11f1-96b4-74563cf85f9d)
high Nessus Plugin ID 364572
Synopsis
The remote FreeBSD host is missing one or more security-related updates.Description
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0f5aaca7-c4d5-11f1-96b4-74563cf85f9d advisory.[email protected] reports:
WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4.
WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysql_dav_provider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected _exists_record_by_primary_key, _get_field_by_primary_key, and _get_record_by_primary_key methods are part of a shipped example provider that is not enabled by default. An attacker who can access a share explicitly configured with this non-default provider can inject SQL through a normal GET request; anonymously exposed read shares permit a status-code oracle and extraction of arbitrary data reachable by the configured MySQL account. This issue is fixed in version 4.3.5.
The WsgiDAV project reports:
When follow_symlinks is false (the default), WsgiDAV is expected to prevent serving content through symbolic links - a request for a symlink returns 403 Forbidden: Symlink support is disabled.
However, that guard inspects only the leaf component of the resolved path, and the root-containment check is purely lexical (os.path.abspath, which does not resolve symlinks).
As a result, a symlink used as an intermediate directory in the request path is neither blocked by the guard nor caught by the containment check, and the request escapes the configured share root. This allows reading, writing, and deleting files outside the root.
Tenable has extracted the preceding description block directly from the FreeBSD security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.See Also
http://www.nessus.org/u?07e8af53
http://www.nessus.org/u?149577d9
Plugin Details
Severity: High
ID: 364572
File Name: freebsd_pkg_0f5aaca7c4d511f196b474563cf85f9d.nasl
Version: 1.1
Type: Local
Family: FreeBSD Local Security Checks
Published: 10/11/2026
Updated: 10/11/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 58.15
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:P
CVSS Score Source: CVE-2026-48099
CVSS v3
Risk Factor: High
Base Score: 7.1
Temporal Score: 6.2
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.8
Threat Score: 6.7
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score Source: CVE-2026-55509
Vulnerability Information
CPE: cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:py311-wsgidav, p-cpe:/a:freebsd:freebsd:py312-wsgidav, p-cpe:/a:freebsd:freebsd:py313-wsgidav, p-cpe:/a:freebsd:freebsd:py313t-wsgidav, p-cpe:/a:freebsd:freebsd:py314-wsgidav, p-cpe:/a:freebsd:freebsd:py314t-wsgidav, p-cpe:/a:freebsd:freebsd:py315-wsgidav
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Exploit Ease: No known exploits are available
Patch Publication Date: 10/11/2026
Vulnerability Publication Date: 5/25/2026