CVE-2026-48099

Name of the Vulnerable Software and Affected Versions WsgiDAV version 4.3.3

Description An issue exists in the FilesystemProvider. loc to file path() function where the application fails to properly validate path boundaries when using a filesystem-backed share. The method uses os.path.abspath(os.path.join(root path, *path parts)) and checks containment via file path.startswith(root path), which allows a request path containing an encoded parent-directory segment (such as /%2e%2e/) to escape the configured share root. This occurs if a sibling path exists that starts with the same root path string and the process has necessary OS permissions. This can allow unauthorized GET, PUT, and DELETE requests to operate on files outside the intended directory.

Recommendations Update WsgiDAV to version 4.3.4.