mar10 Vulnerabilities and Affected Products

Open in search

Vulnerabilities associated with wsgidav.

Products

Clear product

Showing 2 vulnerabilities on this page for wsgidav

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

WsgiDAV encoded dot segments can escape filesystem share roots

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4.

CWE-22Aug 13, 2026
CVSS7.1v3.1EPSS-PoCs0SignalsSTIX

wsgidav is vulnerable to Cross-Site Scripting (XSS) when directory browsing is enabled

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Implementations using this library with directory browsing enabled may be susceptible to Cross Site Scripting (XSS) attacks. This issue has been patched, users can upgrade to version 4.1.0. As a workaround, set `dir_browser.enable = False` in the configuration.

CWE-79Nov 11, 2022
CVSS8.2v3.1EPSS0.339%PoCs0SignalsSTIX