← Back to the live CVE advisory feed

CVE-2026-55509: Product identification pending

Severity

8.8 (HIGH)

Affected versions

Before 4.3.5

Fixed version

4.3.5.

Patch status

Patched

Published

2026-08-28T20:18:27.810

Modified

2026-08-28T22:16:50.747

Why it matters

High-severity vulnerability requiring prioritized review.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.

Technical summary

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysql_dav_provider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected _exists_record_by_primary_key, _get_field_by_primary_key, and _get_record_by_primary_key methods are part of a shipped example provider that is not enabled by default. An attacker who can access a share explicitly configured with this non-default provider can inject SQL through a normal GET request; anonymously exposed read shares permit a status-code oracle and extraction of arbitrary data reachable by the configured MySQL account. This issue is fixed in version 4.3.5.

View the official NVD record for CVE-2026-55509

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.