TI-2026-35539 Aliases CVE-2026-48099 GHSA-wxq4-cc2q-338q

WsgiDAV encoded dot segments can escape filesystem share roots

LOW 33CWE-22Published 2026-08-13 · Updated 2026-08-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00331 26th percentileScored 2026-11-07

Fix Fixed wsgidav (mar10): 4.3.4wsgidav (PyPI): 4.3.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
mar10	wsgidav	before 4.3.4	4.3.4	Patch available	CNA
—	wsgidav (PyPI)	before 4.3.4	4.3.4	Patch available	GHSA-wxq4-cc2q-338q

wsgidav Vendormar10 Affected before 4.3.4 Fixed in 4.3.4 Patch available CNA
wsgidav (PyPI) Vendor— Affected before 4.3.4 Fixed in 4.3.4 Patch available GHSA-wxq4-cc2q-338q

Remediation

Fix · CNA wsgidav (mar10) Fixed in 4.3.4
Fix · GHSA-wxq4-cc2q-338q wsgidav (PyPI) Fixed in 4.3.4 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-48099
2026-10-03 Alias added: GHSA-wxq4-cc2q-338q

References

Other 4

TI-2026-40055 WsgiDAV: Blind SQL injection in the MySQL provider CVSS 4.0HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences