CVE-2026-55509

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysql_dav_provider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected _exists_record_by_primary_key, _get_field_by_primary_key, and _get_record_by_primary_key methods are part of a shipped example provider that is not enabled by default. An attacker who can access a share explicitly configured with this non-default provider can inject SQL through a normal GET request; anonymously exposed read shares permit a status-code oracle and extraction of arbitrary data reachable by the configured MySQL account. This issue is fixed in version 4.3.5.

• CWE-89

• https://github.com/mar10/wsgidav/blob/master/CHANGELOG.md#435--2026-06-27
• https://github.com/mar10/wsgidav/commit/6f35776c9188f130ab044ce557015d51aaa83500
• https://github.com/mar10/wsgidav/releases/tag/v4.3.5
• https://github.com/mar10/wsgidav/security/advisories/GHSA-p6gw-4frg-j7jw
• https://github.com/mar10/wsgidav/security/advisories/GHSA-p6gw-4frg-j7jw

Published

Aug 28, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55497Cloudreve is a self-hosted file management and sharing syste…6.5
• CVE-2026-55499Cloudreve is a self-hosted file management and sharing syste…4.3
• CVE-2026-5550A vulnerability was identified in Tenda AC10 16.03.10.10_mul…8.8
• CVE-2026-555009Router is an AI router & token saver. Prior to 0.4.80, the …9.9
• CVE-2026-555019Router is an AI router & token saver. Prior to 0.4.80, the …7.3
• CVE-2026-55502Cloudreve is a self-hosted file management and sharing syste…7.1
• CVE-2026-5551A security flaw has been discovered in itsourcecode Free Hot…7.3
• CVE-2026-55510ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-55511Yamcs is a mission control framework. Prior to 5.12.8 and 5.…9.1
• CVE-2026-55512nebula-mesh is a self-hosted control plane for Slack Nebula …5.3
• CVE-2026-55513nebula-mesh is a self-hosted control plane for Slack Nebula …5.4
• CVE-2026-55514vLLM is a library for LLM inference and serving. From 0.12.0…6.5