# CVE-2026-55509: WsgiDAV MySQLBrowserProvider blind SQL injection

Source: https://junglewise.ai/threats/cve-2026-55509-wsgidav-mysqlbrowserprovider-blind-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55509 · Severity: high · CVSS 4 · Published 2026-08-28

WsgiDAV's sample MySQL provider module is vulnerable to blind SQL injection when handling database record lookups. An attacker can craft malicious URLs to extract arbitrary data from the backing MySQL database without authentication. Since this provider is often exposed in read-only shares without login requirements, any user who can access the share—including anonymous attackers—can read sensitive database contents by using boolean-based SQL injection techniques.

Technologies: [wsgidav (PyPI)](https://junglewise.ai/threats/technologies/wsgidav). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-55509 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55509 being exploited in the wild.

**How severe is CVE-2026-55509?** High severity, with a CVSS score of 4, published 28 August 2026.

**Which products and versions are affected?** wsgidav (PyPI) <= 4.3.4, ECOSYSTEM:introduced=0,fixed=4.3.5.

**Is there a fix for CVE-2026-55509?** Yes. wsgidav (PyPI): upgrade to 4.3.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55509 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55509?** Check whether you run wsgidav (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- wsgidav (PyPI): upgrade to 4.3.5 or later

  ```sh
  pip install "wsgidav>=4.3.5"
  ```


## Technical details

The MySQLBrowserProvider concatenates user-supplied record keys directly into SQL WHERE clauses without escaping, resulting in queries like `SELECT id FROM testdb.users WHERE id = '<key>'`. A single quote in the key breaks out of the string literal, allowing arbitrary SQL execution. The module's type-checking logic contains a typo (`INTT` instead of `INT`), causing all primary keys to use the quoted branch, making injection possible even for integer columns. The injectable key is evaluated during basic existence checks on GET requests, requiring no authentication, write access, or special HTTP methods. The vulnerability manifests as a status-code oracle: matching SQL conditions return HTTP 500, non-matching conditions return 404, enabling bit-by-bit data extraction. The advisory confirms successful extraction of database records using boolean-based binary search techniques. Patched in version 4.3.5.

## Affected products

- mar10 WsgiDAV <= 4.3.4

## Identifiers

- CVE-2026-55509
- GHSA-p6gw-4frg-j7jw
- PYSEC-2026-3945

## Timeline

- 2026-06-27: disclosed
- 2026-08-28: advisory
- 2026-06-27: patched: Version 4.3.5 released

## References

- [https://api.github.com/users/Jvr2022](https://api.github.com/users/Jvr2022)
- [https://github.com/Jvr2022](https://github.com/Jvr2022)
- [https://api.github.com/users/Jvr2022/gists%7B/gist_id%7D](https://api.github.com/users/Jvr2022/gists%7B/gist_id%7D)
- [https://api.github.com/users/Jvr2022/repos](https://api.github.com/users/Jvr2022/repos)
- [https://avatars.githubusercontent.com/u/109031036?v=4](https://avatars.githubusercontent.com/u/109031036?v=4)
- [https://api.github.com/users/Jvr2022/events%7B/privacy%7D](https://api.github.com/users/Jvr2022/events%7B/privacy%7D)

## Related threats

- [mar10 WsgiDAV path traversal in FilesystemProvider](https://junglewise.ai/threats/cve-2026-48099-mar10-wsgidav-path-traversal-in-filesystemprovider)
- [Cross Site Scripting vulnerability in wsgidav when directory browsing is enabled](https://junglewise.ai/threats/cve-2022-41905-cross-site-scripting-vulnerability-in-wsgidav-when-directory)