WsgiDAV encoded dot segments can escape filesystem share roots
Impact
WsgiDAV 4.3.3 can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout.
Patches
The issue is fixed with version 4.3.4.
Preconditions
The practical impact depends on the deployment.
The deployment uses a filesystem-backed WsgiDAV share.
The attacker can send WebDAV requests accepted by that share. This may be an anonymous share or an authenticated WebDAV user. This is not an authentication bypass.
Details
The issue is in FilesystemProvider._loc_to_file_path(). The method builds a candidate path with os.path.abspath(os.path.join(root_path, *path_parts)), then checks containment with file_path.startswith(root_path). This is not path-boundary aware. For example, if the configured share root is /tmp/share, a resolved sibling path such as /tmp/share_evil/secret.txt still starts with the string /tmp/share.
In a local proof, this allowed GET, PUT, and DELETE requests to operate on files outside the configured share root.
The WSGI/server layer forwards the encoded dot segment to WsgiDAV's PATH_INFO. The local proof used /%2e%2e/..., which wsgiref passed through as /../....
A sibling or neighboring path exists whose absolute path starts with the configured root path string, such as /tmp/share and /tmp/share_evil.
The WsgiDAV process has OS permissions for the outside path.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | wsgidav | < 4.3.4 | 4.3.4 |
References
- https://github.com/mar10/wsgidav/security/advisories/GHSA-wxq4-cc2q-338q
- https://github.com/mar10/wsgidav/commit/f894ed8656d7bdd7438ab8148c5a02546cb15183
- https://github.com/mar10/wsgidav
- https://pypi.org/project/wsgidav
- https://github.com/advisories/GHSA-wxq4-cc2q-338q
- https://nvd.nist.gov/vuln/detail/CVE-2026-48099
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L- Weakness (CWE)
CWE-22- Platform
- Python (PyPI)
- Package
wsgidav- Disclosed
- 11.06.2026
- Updated
- 11.10.2026 14:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-3428 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-wxq4-cc2q-338q - CC BY 4.0
Vulnerability history: wsgidav
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 11.2022 08.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 3
Disclosures per year
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 2
-
WsgiDAV encoded dot segments can escape filesystem share roots this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.