CVE-2026-48099 PUBLISHED

WsgiDAV encoded dot segments can escape filesystem share roots

Assigner: GitHub_M
Reserved: 20.05.2026 Published: 13.08.2026 Updated: 13.08.2026

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS Score: 7.1

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	mar10
Product	wsgidav
Versions	Version < 4.3.4 is affected

References

https://github.com/mar10/wsgidav/security/advisories/GHSA-wxq4-cc2q-338q
https://github.com/mar10/wsgidav/commit/f894ed8656d7bdd7438ab8148c5a02546cb15183
https://github.com/pypa/advisory-database/tree/main/vulns/wsgidav/PYSEC-2026-3428.yaml

Problem Types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE