CVE-2026-55509 Overview
WsgiDAV is a generic and extendable WebDAV server based on Web Server Gateway Interface (WSGI). Versions prior to 4.3.5 ship a sample MySQLBrowserProvider in wsgidav/samples/mysql_dav_provider.py that concatenates a record key parsed from the request URL directly into SQL WHERE clauses. The affected methods _exists_record_by_primary_key, _get_field_by_primary_key, and _get_record_by_primary_key are exposed whenever an administrator explicitly enables this non-default sample provider. The flaw is tracked as SQL Injection [CWE-89] and is fixed in WsgiDAV 4.3.5.
Critical Impact
An unauthenticated attacker reaching a share backed by the vulnerable sample provider can inject SQL through a standard GET request and exfiltrate any data accessible to the configured MySQL account.
Affected Products
- WsgiDAV versions prior to 4.3.5
- Deployments that explicitly enable the MySQLBrowserProvider sample provider
- Anonymously exposed read shares mapped to the vulnerable provider
Discovery Timeline
- 2026-08-28 - CVE-2026-55509 published to the National Vulnerability Database (NVD)
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-55509
Vulnerability Analysis
The vulnerability resides in the sample MySQL provider shipped with WsgiDAV. When a WebDAV client requests a resource, the server parses the record key segment from the URL and passes it to database lookup functions. Those functions build SQL queries by string concatenation rather than using parameterized statements. An attacker controls the injected fragment and can append arbitrary SQL to the WHERE clause.
Because the affected methods are reached through a normal HTTP GET, exploitation does not require WebDAV-specific verbs or authentication when the share is anonymously readable. Server responses expose a status-code oracle: differences in HTTP responses between true and false SQL conditions enable blind boolean-based extraction of arbitrary data reachable by the MySQL account bound to the provider.
Root Cause
The root cause is unsafe string concatenation of untrusted input into SQL statements inside _exists_record_by_primary_key, _get_field_by_primary_key, and _get_record_by_primary_key. The sample provider does not use bound parameters, so no server-side type checking or escaping is applied to the record key.
Attack Vector
The attack vector is remote and network-based over HTTP. The attacker sends a crafted GET request to a resource path served by the vulnerable provider, embedding SQL syntax in the primary key segment. On anonymously exposed read shares, no credentials are required. The response status becomes a boolean oracle, permitting blind SQL injection against tables accessible to the MySQL user configured for the provider.
No verified public exploit code is available. Technical details are documented in GitHub Security Advisory GHSA-p6gw-4frg-j7jw and the WsgiDAV commit that fixes the issue.
Detection Methods for CVE-2026-55509
Indicators of Compromise
- Unusual GET requests to WebDAV share paths containing SQL metacharacters such as single quotes, UNION, SELECT, AND 1=1, or SLEEP-style timing payloads in the final URL segment.
- Elevated volumes of 404 or 500 responses from paths mapped to the MySQLBrowserProvider sample.
- MySQL query logs showing malformed WHERE clauses or references to information_schema originating from the WsgiDAV service account.
Detection Strategies
- Inspect access logs for the WsgiDAV process for requests targeting shares configured with the sample MySQL provider and containing URL-encoded SQL syntax.
- Enable MySQL general or audit logging for the account bound to WsgiDAV and alert on queries that reference schema metadata tables.
- Deploy web application firewall (WAF) rules that flag SQL injection patterns in HTTP request paths, not only query strings and bodies.
Monitoring Recommendations
- Continuously monitor which WsgiDAV deployments have MySQLBrowserProvider enabled and whether their shares permit anonymous access.
- Track outbound data volume and query frequency from the WsgiDAV host to the backing MySQL instance for anomalies consistent with data extraction.
How to Mitigate CVE-2026-55509
Immediate Actions Required
- Upgrade WsgiDAV to version 4.3.5 or later, which replaces the concatenated SQL in the sample provider with safe parameterization.
- Audit configuration files for references to mysql_dav_provider or MySQLBrowserProvider and disable the sample provider unless it is required.
- Restrict access to any share backed by the sample provider using authentication and IP allow-lists until patching is complete.
Patch Information
The fix is included in WsgiDAV Release v4.3.5, published on 2026-06-27. See the WsgiDAV Change Log Entry and the remediation commit for details.
Workarounds
- Disable the MySQLBrowserProvider sample entirely and replace it with a custom provider that uses parameterized queries.
- Bind the WsgiDAV MySQL account to a least-privilege user with access limited to specific tables and columns required for the share.
- Require authentication on all shares to eliminate the anonymous status-code oracle used for blind extraction.
# Configuration example: upgrade WsgiDAV and verify the sample provider is not in use
pip install --upgrade 'wsgidav>=4.3.5'
grep -R "mysql_dav_provider\|MySQLBrowserProvider" /etc/wsgidav/ /opt/wsgidav/
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
