CVE-2026-55509

WsgiDAV before 4.3.5 contains a SQL injection flaw (CWE-89) in its shipped sample MySQLBrowserProvider (wsgidav/samples/mysql_dav_provider.py), where the record key parsed from a request URL is concatenated directly into SQL WHERE clauses by the _exists_record_by_primary_key, _get_field_by_primary_key, and _get_record_by_primary_key methods. An attacker who can reach a share explicitly configured with this provider can inject SQL through a normal GET request. On anonymously exposed read shares, the attacker gains a status-code oracle and can extract arbitrary data reachable by the configured MySQL account, matching the CVSS 4.0 score of 8.8 (high confidentiality, low integrity impact). Only deployments that explicitly enable this non-default example provider are affected; it is not active in default WsgiDAV configurations. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS estimates only a 0.4% chance of exploitation in the next 30 days, indicating no known exploitation at this time.

What to do: Upgrade to WsgiDAV 4.3.5 or later. If upgrading is not immediately possible, remove or stop using the sample MySQLBrowserProvider, avoid exposing its shares anonymously, and restrict the configured MySQL account to minimal privileges. Audit your WsgiDAV configuration to confirm whether any shares reference mysql_dav_provider, and review logs for suspicious GET requests against those shares.