CVE-2026-48099: 
Python vulnerability analysis and mitigation

CVE-2026-48099 is a path traversal vulnerability in WsgiDAV (a Python WebDAV server library) that allows attackers to escape the configured filesystem share root by sending WebDAV requests with encoded parent-directory segments (e.g., %2e%2e). It affects WsgiDAV versions up to and including 4.3.3, and was first published on May 27, 2026, with the GitHub Advisory Database entry updated on June 11, 2026. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory).

The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The flaw resides in FilesystemProvider._loc_to_file_path(), which constructs a candidate file path using os.path.abspath(os.path.join(root_path, *path_parts)) and then validates containment with file_path.startswith(root_path) — a string prefix check that is not path-boundary-aware. For example, if the share root is /tmp/share, a resolved path like /tmp/share_evil/secret.txt incorrectly passes the check because it starts with the string /tmp/share. Exploitation requires the WSGI/server layer to forward encoded dot segments (e.g., /%2e%2e/) to WsgiDAV's PATH_INFO, which wsgiref does by passing them through as /../..., enabling traversal to sibling directories accessible to the WsgiDAV process (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to perform unauthorized GET (read), PUT (write), and DELETE operations on files outside the configured WebDAV share root, provided the WsgiDAV process has OS-level permissions to those paths and a sibling directory exists whose absolute path string-prefixes the share root. This results in high confidentiality and integrity impact — sensitive files outside the share can be read or exfiltrated, and arbitrary files can be created or deleted — with low availability impact. The scope is limited to the filesystem accessible by the WsgiDAV process account (GitHub Advisory).

A local proof-of-concept was demonstrated by the reporter (0xHunSec) as part of the responsible disclosure, confirming that GET, PUT, and DELETE requests can operate on out-of-scope files. The CVE status is currently "Reserved" and there is no evidence of in-the-wild exploitation or inclusion in the CISA KEV catalog at this time. The EPSS score is approximately 0.072% (22nd percentile), indicating a low near-term exploitation probability. Exploitation requires low privileges (access to the WebDAV share, which may be anonymous or authenticated) and high attack complexity due to the specific path layout precondition (GitHub Advisory).

1. Reconnaissance: Identify a WsgiDAV instance running version ≤ 4.3.3 with a filesystem-backed share. Determine the share root path and check whether sibling directories (e.g., /tmp/share_evil) exist adjacent to the configured root (e.g., /tmp/share) and are accessible by the WsgiDAV process.
2. Obtain share access: Gain access to the WebDAV share — this may be an anonymous share or require valid WebDAV credentials. This vulnerability does not bypass authentication.
3. Craft traversal request: Send a WebDAV HTTP request (GET, PUT, or DELETE) with a URL-encoded parent-directory segment in the path, such as GET /%2e%2e/share_evil/secret.txt HTTP/1.1. The WSGI layer (e.g., wsgiref) forwards this as /../share_evil/secret.txt in PATH_INFO.
4. Bypass containment check: WsgiDAV resolves the path to /tmp/share_evil/secret.txt via os.path.abspath(). The flawed startswith('/tmp/share') check passes because the sibling path string-prefixes the root.
5. Achieve out-of-scope file access: Read, write, or delete the target file outside the configured share root, limited only by the OS permissions of the WsgiDAV process (GitHub Advisory, Fix Commit).

• Network: WebDAV HTTP requests (GET, PUT, DELETE) containing URL-encoded dot segments such as %2e%2e or %2E%2E in the request path; requests resolving to paths outside the expected share root directory.
• Logs: WsgiDAV access logs showing requests with encoded traversal sequences (e.g., /%2e%2e/) in the URL path; absence of a Security exception: tried to access file outside root error in logs where traversal succeeded (pre-patch behavior).
• File System: Unexpected file creation, modification, or deletion in directories adjacent to (but outside) the configured WebDAV share root; new or altered files in sibling directories whose names share a string prefix with the share root path.
• Process: WsgiDAV process performing file I/O on paths outside the configured share root directory as observed via OS-level auditing (e.g., auditd, inotify) (GitHub Advisory).

Upgrade WsgiDAV to version 4.3.4, which fixes the vulnerability by replacing the string prefix check with a path-boundary-aware comparison: appending os.sep to both the root path and the candidate path before calling startswith(), ensuring sibling directories are correctly rejected (Fix Commit). No official configuration-based workaround is provided; upgrading is the recommended remediation. As a defense-in-depth measure, ensure the WsgiDAV process runs with the minimum OS permissions necessary and that no sensitive sibling directories share a string prefix with the configured share root path (GitHub Advisory).

The vulnerability was reported by security researcher 0xHunSec and credited in the GitHub Security Advisory. Fedora issued an update advisory for the python-wsgidav package in response to this CVE, and Tenable published Nessus detection plugins (IDs 318361 and 318367) to identify vulnerable installations. No significant broader media coverage or notable social media discussion has been identified beyond standard advisory distribution channels (GitHub Advisory).