Description

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T20:17:22.313Z",
  "pubdate": "2026-08-13T20:17:22.313Z",
  "executiveSummary": "WsgiDAV versions 4.3.3 and prior are susceptible to a path traversal vulnerability that permits unauthorized access to the underlying filesystem outside of the designated WebDAV share root.\nThe vulnerability arises when a WebDAV request path incorporates an encoded parent-directory segment within a specific path layout, bypassing intended boundary restrictions enforced by the application.\nSuccessful exploitation of this flaw grants an attacker the ability to traverse the directory structure and potentially access sensitive files and resources located outside the configured filesystem share boundaries.\nThis security deficiency affects deployments of the WsgiDAV server running vulnerable versions up to 4.3.3, presenting significant risks to confidentiality and integrity if exposed to malicious actors.\nAttackers can leverage this capability remotely by crafting specialized HTTP requests containing encoded directory traversal sequences without requiring prior authentication or elevated privileges, provided the service is accessible over the network.",
  "technicalDetails": "The vulnerability resides in the request path parsing and normalization logic of the WsgiDAV WebDAV server, specifically within components responsible for mapping requested URIs to the local filesystem share root.\nThe root cause stems from improper sanitization and handling of encoded parent-directory segments within specific path layouts, allowing traversal sequences to evade standard string checks and manipulate the final filesystem path resolution.\nAttackers exploit this behavior by issuing specially crafted WebDAV requests where path parameters include URL-encoded traversal sequences, such as encoded dot-dot-slash patterns.\nWhen processed by the vulnerable WsgiDAV server, the path parsing engine fails to adequately decode, normalize, and restrict the resulting path to the configured share root boundary.\nConsequently, the server resolves the path against the broader system filesystem, granting access to directories and files residing outside the intended virtual share.\nThe attack flow proceeds as follows: 1) The attacker crafts an HTTP request containing an encoded parent-directory segment within the WebDAV request path; 2) The WsgiDAV server receives the request and processes the path through the vulnerable normalization routine; 3) The improper validation allows the encoded segments to bypass boundary checks; 4) The server accesses the targeted resource outside the share root and returns the contents or executes the requested WebDAV method against the unauthorized path.\nThis vulnerability impacts WsgiDAV versions 4.3.3 and prior. The issue is fully resolved in version 4.3.4."
}