CVE-2026-55509
Received Received - Intake

SQL Injection in WsgiDAV Sample MySQL Provider

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description
WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysql_dav_provider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected _exists_record_by_primary_key, _get_field_by_primary_key, and _get_record_by_primary_key methods are part of a shipped example provider that is not enabled by default. An attacker who can access a share explicitly configured with this non-default provider can inject SQL through a normal GET request; anonymously exposed read shares permit a status-code oracle and extraction of arbitrary data reachable by the configured MySQL account. This issue is fixed in version 4.3.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-29
AI Q&A
2026-08-29
EPSS Evaluated
N/A
NVD
CVE-2026-55509
EUVD
EUVD-2026-67857

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wsgidav wsgidav to 4.3.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55509 is a blind SQL injection vulnerability in the WsgiDAV MySQL provider affecting versions 4.3.4 and earlier. The issue occurs because the sample MySQLBrowserProvider directly concatenates user-supplied input from URLs into SQL WHERE clauses without proper escaping or validation. Attackers can inject malicious SQL code through URL paths to access unauthorized database data.

Detection Guidance

Check if WsgiDAV is running and if the MySQLBrowserProvider is enabled by inspecting configuration files for wsgidav.conf or similar. Look for SQL errors in logs when accessing shares with URLs like /db/users/1' OR '1'='1. Use tools like sqlmap to test for blind SQL injection by sending payloads and observing HTTP status codes (500 vs 404).

Commands: curl -v http://target/db/users/1' OR '1'='1; check server logs for SQL errors; use sqlmap -u http://target/db/users/1 --batch to automate detection.

Impact Analysis

This vulnerability allows attackers to read arbitrary data from the database with the privileges of the WsgiDAV database account. If the account has write or administrative privileges, attackers could further compromise data integrity. Exploitation requires access to a share configured with the vulnerable MySQLBrowserProvider, which is not enabled by default.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust due to compromised confidentiality and integrity of sensitive data.

Mitigation Strategies

Upgrade WsgiDAV to version 4.3.5 or later to address the vulnerability. Disable the MySQLBrowserProvider module if it is enabled in your configuration. Ensure database accounts used by WsgiDAV have minimal privileges to limit data exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55509. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart