wsgidav is vulnerable to Cross-Site Scripting (XSS) when directory browsing is enabled
Priority LOW 38CWE-79Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
WsgiDAV is a generic and extendable WebDAV server based on WSGI. Implementations using this library with directory browsing enabled may be susceptible to Cross Site Scripting (XSS) attacks. This issue has been patched, users can upgrade to version 4.1.0. As a workaround, set `dir_browser.enable = False` in the configuration.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00371 31st percentileScored 2026-11-07
Fix Fixed wsgidav (mar10): 4.1.0wsgidav (PyPI): 4.1.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| mar10 | wsgidav | 3.0.0a1 to before 4.1.0 | 4.1.0 | Patch available | CNA |
| — | wsgidav (PyPI) | 3.0.0a1 to before 4.1.0 | 4.1.0 | Patch available | GHSA-xx6g-jj35-pxjv |
- wsgidav Vendormar10 Affected 3.0.0a1 to before 4.1.0 Fixed in 4.1.0 Patch available CNA
- wsgidav (PyPI) Vendor— Affected 3.0.0a1 to before 4.1.0 Fixed in 4.1.0 Patch available GHSA-xx6g-jj35-pxjv
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wsgidav_project:wsgidav:*:*:*:*:*:*:*:* | 3.0.0 to before 4.1.0 | Vulnerable | Wsgidav Project |
- cpe:2.3:a:wsgidav_project:wsgidav:*:*:*:*:*:*:*:* Versions 3.0.0 to before 4.1.0 Vulnerable ·Wsgidav Project
Remediation
- Fix · CNA wsgidav (mar10) Fixed in 4.1.0
- Fix · GHSA-xx6g-jj35-pxjv wsgidav (PyPI) Fixed in 4.1.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-41905
- 2026-10-03 Alias added: GHSA-xx6g-jj35-pxjv
References
Advisory 2
More mar10 vulnerabilities
- TI-2026-40055 WsgiDAV: Blind SQL injection in the MySQL provider CVSS 4.0HIGH 8.8
- TI-2026-35539 WsgiDAV encoded dot segments can escape filesystem share roots CVSS 3.1HIGH 7.1
Sources
- CVE-2022-41905 · CVE Program
- CVE-2022-41905 · NVD
- FIRST EPSS
- GHSA-xx6g-jj35-pxjv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences