WebDAV Server SQL Injection Vulnerability in WsgiDAV
CVE-2026-55509

8.8HIGH

Key Information:

Vendor

Mar10

Status
Wsgidav
Vendor
CVE Published:
28 August 2026

What is CVE-2026-55509?

WsgiDAV, a versatile WebDAV server, has a vulnerability stemming from its MySQLBrowserProvider component, found in versions prior to 4.3.5. This issue arises because user inputs are incorrectly concatenated into SQL WHERE clauses, specifically in methods handling primary keys. If an attacker gains access to a share tailored for this provider—albeit not enabled by default—they can exploit this flaw via standard GET requests for SQL injection. Such a scenario allows malicious users to utilize exposed read shares to leak sensitive information and conduct unauthorized data extractions using the connected MySQL account. For safety, users are advised to update to version 4.3.5 or later.

Affected Version(s)

wsgidav < 4.3.5

References

https://github.com/mar10/wsgidav/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/mar10/wsgidav/commit/6f35776c9188f130a...
x_refsource_MISC
https://github.com/mar10/wsgidav/blob/master/CHANGELOG.md...
x_refsource_MISC

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.