CVE-2026-55509: 
Python vulnerability analysis and mitigation

CVE-2026-55509 is a blind SQL injection vulnerability in the sample MySQLBrowserProvider component of WsgiDAV, a WSGI-based WebDAV server. The flaw allows unauthenticated remote attackers to inject arbitrary SQL through crafted GET request URLs, enabling extraction of any data accessible to the configured MySQL account. It affects WsgiDAV versions up to and including 4.3.4; version 4.3.5 (released June 27, 2026) contains the fix. The vulnerability carries a CVSS v4.0 base score of 8.8 (High) (Github Advisory, wsgidav Advisory).

The root cause (CWE-89) is unsanitized string concatenation of the record key parsed from the request URL path directly into SQL WHERE clauses in three methods: _exists_record_by_primary_key, _get_field_by_primary_key, and _get_record_by_primary_key within wsgidav/samples/mysql_dav_provider.py. A URL path such as /db/users/1 is split into a table name (validated against real tables) and a primary key value (not validated), which is inserted verbatim into queries like SELECT id FROM testdb.users WHERE id = '<key>'. A compounding typo (INTT instead of INT) in the numeric-type check forces even integer keys through the quoted branch, making them equally injectable via a single-quote breakout. Exploitation requires only a standard HTTP GET request — no authentication, write access, or special HTTP method is needed — making this a fully unauthenticated, network-accessible attack (wsgidav Advisory, Patch Commit).

Successful exploitation allows an unauthenticated attacker to read arbitrary data from the MySQL database that WsgiDAV connects to, using a boolean (status-code) oracle — HTTP 500 for a true condition, HTTP 404 for false — to extract data bit by bit. The primary impact is high confidentiality loss; integrity may also be at risk if the configured MySQL account holds write or administrative privileges. The scope is limited to deployments that explicitly enable the non-default MySQLBrowserProvider; standard filesystem-provider installations are unaffected (wsgidav Advisory, Github Advisory).

A working proof-of-concept (PoC) was included in the original advisory and confirmed against MySQL 8 and WsgiDAV 4.3.4, demonstrating both the boolean oracle and full automated data extraction with no authentication. NVD's SSVC assessment classifies exploitation as having a PoC available and being automatable. The EPSS score is approximately 0.398% (33rd percentile). No in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not currently listed in the CISA KEV catalog (Github Advisory, wsgidav Advisory).

1. Reconnaissance: Identify internet-facing WsgiDAV instances (e.g., via Shodan searching for WebDAV servers) running versions ≤ 4.3.4 with a share explicitly configured to use MySQLBrowserProvider (typically mapped to a path like /db).
2. Confirm provider presence: Send a benign GET request to the share root (e.g., GET /db/) and observe a directory listing of database tables, confirming the MySQL provider is active.
3. Verify injection with boolean oracle: Send two crafted GET requests with URL-encoded SQL payloads in the record key position:
   • True condition: curl -s -o /dev/null -w "%{http_code}\n" "http://<target>/db/users/0%27%20OR%20%271%27%3D%271" → returns HTTP 500
   • False condition: curl -s -o /dev/null -w "%{http_code}\n" "http://<target>/db/users/0%27%20OR%20%271%27%3D%272" → returns HTTP 404
   • The differing status codes confirm SQL injection is active.
4. Automate data extraction: Use a binary-search script over the boolean oracle to extract arbitrary data character by character. For example, to dump credentials: extract("SELECT GROUP_CONCAT(name,0x3a,secret) FROM users") — iterating ASCII(MID(...)) comparisons via crafted URL payloads.
5. Expand access: If the MySQL account has write or admin privileges, escalate to data modification or further database compromise using the same injection channel (wsgidav Advisory, Github Advisory).

• Network: Repeated HTTP GET requests to paths matching the pattern /<share>/<table>/ containing URL-encoded single quotes (%27), OR, AND, SELECT, ASCII, MID, or GROUP_CONCAT in the record key segment; unusual volume of requests to the WebDAV share returning alternating HTTP 500 and 404 responses from the same source IP.
• Logs: WsgiDAV access logs showing GET requests with encoded SQL syntax in URL path components (e.g., %27%20OR%20, %27%20AND%20); rapid sequential requests differing only in the injected condition value, consistent with binary-search data extraction.
• Application: MySQL query logs (if enabled) showing dynamically constructed SELECT statements with injected conditions such as WHERE id = '0' OR ('1'='1') or WHERE id = '0' OR (SELECT ASCII(MID(...))>N).

Upgrade WsgiDAV to version 4.3.5 or later, which replaces all string-concatenated SQL queries in mysql_dav_provider.py with parameterized statements and properly escaped identifiers (wsgidav Release, Patch Commit). As an immediate workaround for deployments that cannot upgrade, disable or remove the MySQLBrowserProvider from the WsgiDAV configuration entirely — installations using only the default filesystem provider are not affected. Additionally, enforce authentication on any WebDAV share to eliminate anonymous access, and restrict the MySQL account used by WsgiDAV to the minimum required privileges (read-only, limited to specific tables) to reduce the blast radius of any future exploitation (wsgidav Advisory).

The vulnerability was reported by researcher Jvr2022 and published by the maintainer (mar10) on June 27, 2026, with the fix included in the same release. Fedora Linux issued security updates for python-wsgidav packages for Fedora 43 and 44 shortly after public disclosure. Coverage appeared on Linux security news aggregators and German-language security news site pro-linux.de. No significant broader community controversy or vendor dispute has been noted, consistent with the limited deployment scope of the non-default provider.