CVE-2026-55509: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in mar10 wsgidav

The vulnerability exists in the sample MySQLBrowserProvider in wsgidav/samples/mysql_dav_provider.py prior to version 4.3.5. The methods _exists_record_by_primary_key, _get_field_by_primary_key, and _get_record_by_primary_key concatenate record keys parsed from request URLs directly into SQL WHERE clauses without proper neutralization. This improper neutralization of special elements in SQL commands (CWE-89) allows an attacker who can access a share explicitly configured with this non-default provider to inject SQL through normal GET requests. Anonymously exposed read shares can be exploited as a status-code oracle to extract arbitrary data accessible by the configured MySQL account. The vulnerability is resolved in wsgidav version 4.3.5.

An attacker with access to a share configured to use the vulnerable MySQLBrowserProvider can perform SQL injection attacks, potentially extracting arbitrary data accessible by the MySQL account used by the provider. This can lead to unauthorized data disclosure. The vulnerability only affects setups where the non-default sample provider is explicitly enabled. Default configurations are not affected.

This vulnerability is fixed in wsgidav version 4.3.5. Users should upgrade to version 4.3.5 or later to remediate this issue. Since the vulnerable code is part of a non-default example provider, disabling or not enabling this provider also mitigates the risk. No other mitigation or temporary fix is documented.