wsgidav vulnerabilities

2 known vulnerabilities in wsgidav from Mar10. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  wsgidav: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-55509Aug 28, 2026Mar10

  WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysql_dav_provider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected _exist

• 7.1 High severity

  wsgidav: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-48099Aug 13, 2026Mar10

  WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed