CVE-2026-48099

CVE-2026-48099 is a path traversal vulnerability in WsgiDAV versions prior to 4.3.4 that allows attackers to escape share containment using double-encoded sequences like %2e%2e. The vulnerability is well-described in public sources, but the deeper lesson for defenders is why it persisted: path normalization in WebDAV servers is treated as a solved engineering problem rather than an ongoing security-critical surface requiring continuous adversarial testing. The root cause is architectural, not merely a missing test case. WebDAV path handling involves three distinct parsing contexts—URL encoding semantics, filesystem path semantics, and application-level share containment—that interact in non-obvious ways. When validation happens at a discrete point in the request lifecycle and the result is trusted downstream, any encoding bypass means the "validated" path can be misused in subsequent operations (PUT, DELETE, MOVE, LOCK) without re-checking. This is why single-encoding bypasses have a persistent genealogy in WebDAV servers, and why a localized patch addressing only the %2e%2e variant may leave other normalization layers (Unicode, mixed separators, case variants) exploitable. Your immediate priorities: apply the 4.3.4 update, but treat this as the first data point in an ongoing enumeration problem, not a completed remediation. Audit your deployment context—if WsgiDAV sits behind an nginx reverse proxy that normalizes paths before forwarding, the exploit chain may require additional conditions. More critically, review any custom extensions, property handlers, lock managers, or share mappers your deployment uses; these often inherit the same flawed normalization assumptions and won't be patched by the upstream release. The 7.1 CVSS and low EPSS reflect external discoverability, not operational impact: an internal file server with WebDAV interface handling sensitive data is a high-value lateral movement target regardless of internet exposure. Consider this vulnerability a signal to review whether path validation in your WebDAV stack is treated as a security surface with dedicated adversarial testing, or as application logic delegated to feature developers who moved on after the initial implementation passed its test suite.

Reviewed through automated stages and approved by a human before publication.