https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 08:55:30 +0000 https://cve.radiocsirt.org/vuln/cve-2026-48099 <p><strong>Affected:</strong> mar10 wsgidav</p> <p>WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4.</p> <p><strong>Affected:</strong> mar10 wsgidav</p> <p>WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4.</p> https://cve.radiocsirt.org/vuln/cve-2026-48099 https://cve.radiocsirt.org/vuln/pysec-2026-3428 <p><strong>Affected:</strong> PyPI: wsgidav</p> <p>### Impact WsgiDAV 4.3.3 can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout.</p> <p>### Patches The issue is fixed with version 4.3.4.</p> <p>### Preconditions</p> <p>The practical impact depends on the deployment.</p> <p>The deployment uses a filesystem-backed WsgiDAV share.</p> <p>The attacker can send WebDAV requests accepted by that share. This may be an anonymous share or an authenticated WebDAV user. This is not an authentication bypass.</p> <p>### Details</p> <p>The issue is in `FilesystemProvider._loc_to_file_path()`. The method builds a candidate path with `os.path.abspath(os.path.join(root_path, *path_parts))`, then checks containment with `file_path.startswith(root_path)`. This is not path-boundary aware. For example, if the configured share root is `/tmp/share`, a resolved sibling path such as `/tmp/share_evil/secret.txt` still starts with the string `/tmp/share`.</p> <p>In a local proof, this allowed GET, PUT, and DELETE requests to operate on files outside the configured share root.</p> <p>The WSGI/server layer forwards the encoded dot segment to WsgiDAV&#39;s PATH_INFO. The local proof used `/%2e%2e/...`, which wsgiref passed through as `/../...`.</p> <p>A sibling or neighboring path exists whose absolute path starts with the configured root path string, such as `/tmp/share` and `/tmp/share_evil`.</p> <p>The WsgiDAV process has OS permissions for the outside path.</p> <p><strong>Affected:</strong> PyPI: wsgidav</p> <p>### Impact WsgiDAV 4.3.3 can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout.</p> <p>### Patches The issue is fixed with version 4.3.4.</p> <p>### Preconditions</p> <p>The practical impact depends on the deployment.</p> <p>The deployment uses a filesystem-backed WsgiDAV share.</p> <p>The attacker can send WebDAV requests accepted by that share. This may be an anonymous share or an authenticated WebDAV user. This is not an authentication bypass.</p> <p>### Details</p> <p>The issue is in `FilesystemProvider._loc_to_file_path()`. The method builds a candidate path with `os.path.abspath(os.path.join(root_path, *path_parts))`, then checks containment with `file_path.startswith(root_path)`. This is not path-boundary aware. For example, if the configured share root is `/tmp/share`, a resolved sibling path such as `/tmp/share_evil/secret.txt` still starts with the string `/tmp/share`.</p> <p>In a local proof, this allowed GET, PUT, and DELETE requests to operate on files outside the configured share root.</p> <p>The WSGI/server layer forwards the encoded dot segment to WsgiDAV&#39;s PATH_INFO. The local proof used `/%2e%2e/...`, which wsgiref passed through as `/../...`.</p> <p>A sibling or neighboring path exists whose absolute path starts with the configured root path string, such as `/tmp/share` and `/tmp/share_evil`.</p> <p>The WsgiDAV process has OS permissions for the outside path.</p> https://cve.radiocsirt.org/vuln/pysec-2026-3428