Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-55509— WsgiDAV: Blind SQL injection in the MySQL provider

Quick assessment

Affected
mar10 wsgidav
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WsgiDAV 是一个基于 WSGI 的通用且可扩展的 WebDAV 服务器。在 4.3.5 版本之前， 中的示例 MySQLBrowserProvider 会将从请求 URL 中解析出的记录键直接拼接进 SQL WHERE 子句。受影响的 、 和 方法是该示例提供商的一部分，而该提供商随版本一起发布，但默认未启用。能够访问明确配置了此非默认提供商的共享区的攻击者，可以通过普通的 GET 请求注入 SQL；匿名公开的只读共享区允许利用状态码预言机（status-code oracle）提取配置好的 MySQL 账户

CVSS 8.8 · High

Possible ATT&CK Techniques 1 AI

T1210 · Exploitation of Remote Services

Affected Version Matrix 1

VendorProduct Version RangeStatus
mar10 wsgidav < 4.3.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55509

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WsgiDAV: Blind SQL injection in the MySQL provider
Source: CVE Program / CVE List V5
Vulnerability Description
WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysql_dav_provider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected _exists_record_by_primary_key, _get_field_by_primary_key, and _get_record_by_primary_key methods are part of a shipped example provider that is not enabled by default. An attacker who can access a share explicitly configured with this non-default provider can inject SQL through a normal GET request; anonymously exposed read shares permit a status-code oracle and extraction of arbitrary data reachable by the configured MySQL account. This issue is fixed in version 4.3.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
mar10 wsgidav < 4.3.5 -

II. Public POCs for CVE-2026-55509

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55509

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55509 (2)

Vendor Advisories for CVE-2026-55509 (1)

Vendor Pages for CVE-2026-55509 (1)

IV. Related Vulnerabilities

Same product: wsgidav
Same vendor: mar10
Same weakness: CWE-89

V. Comments for CVE-2026-55509

No comments yet

Leave a comment