CVE-2026-55509

Name of the Vulnerable Software and Affected Versions WsgiDAV versions prior to 4.3.5

Description The sample MySQLBrowserProvider in wsgidav/samples/mysql dav provider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. This occurs within the exists record by primary key(), get field by primary key(), and get record by primary key() methods. An attacker with access to a share configured with this non-default provider can perform SQL injection via a GET request. In cases of anonymously exposed read shares, this can lead to a status-code oracle and the extraction of arbitrary data accessible by the configured MySQL account.

Recommendations Update to version 4.3.5. As a temporary mitigation, avoid using the mysql dav provider.py sample provider.