Every CVE Search/ Get API key

CVE-2022-41905

wsgidav is vulnerable to Cross-Site Scripting (XSS) when directory browsing is enabled

8.2 HighFix available

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Implementations using this library with directory browsing enabled may be susceptible to Cross Site Scripting (XSS) attacks. This issue has been patched, users can upgrade to version 4.1.0. As a workaround, set dir_browser.enable = False in the configuration.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.37%Down 0.5 points since Nov 12, 2022
90%50%10%1%

What each source reports

CVE List Score used 8.2

wsgidav is vulnerable to Cross-Site Scripting (XSS) when directory browsing is enabled

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Implementations using this library with directory browsing enabled may be susceptible to Cross Site Scripting (XSS) attacks. This issue has been patched, users can upgrade to version 4.1.0. As a workaround, set dir_browser.enable = False in the configuration.

Record
CVE-2022-41905
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2022-0366 8.2

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Implementations using this library with directory browsing enabled may be susceptible to Cross Site Scripting (XSS) attacks. This issue has been patched, users can upgrade to version 4.1.0. As a workaround, set dir_browser.enable = False in the configuration.

Record
EUVD-2022-0366
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-xx6g-jj35-pxjv 8.2

Cross Site Scripting vulnerability in wsgidav when directory browsing is enabled

Impact

Implementations using this library with directory browsing enabled may be susceptible to Cross Site Scripting (XSS) attacks.

Patches

Users can upgrade to v4.1.0

Workarounds

Set dir_browser.enable = False in the configuration. For instance, when using a Python dictionary to configure the library:

config = {
    # your normal configuration
    "dir_browser": {
      "enable": False
    },
}
app = WsgiDAVApp(config)

For more information

Note that an attacker cannot exploit this vulnerability, by simply uploading a file or folder with a manipulated file name. However if the WsgiDAV library is used in a scenario where untrusted data is displayed in the directory browser's user interface (e.g. 'realm' or user name, ...) XSS may happen.

If you have any questions or comments about this advisory:

Record
GHSA-xx6g-jj35-pxjv
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 8.2

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Implementations using this library with directory browsing enabled may be susceptible to Cross Site Scripting (XSS) attacks. This issue has been patched, users can upgrade to version 4.1.0. As a workaround, set dir_browser.enable = False in the configuration.

Record
CVE-2022-41905
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 8.2

wsgidav is vulnerable to Cross-Site Scripting (XSS) when directory browsing is enabled

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Implementations using this library with directory browsing enabled may be susceptible to Cross Site Scripting (XSS) attacks. This issue has been patched, users can upgrade to version 4.1.0. As a workaround, set dir_browser.enable = False in the configuration.

Record
CVE-2022-41905
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-xx6g-jj35-pxjv 8.2

Cross Site Scripting vulnerability in wsgidav when directory browsing is enabled

Impact

Implementations using this library with directory browsing enabled may be susceptible to Cross Site Scripting (XSS) attacks.

Patches

Users can upgrade to v4.1.0

Workarounds

Set dir_browser.enable = False in the configuration. For instance, when using a Python dictionary to configure the library:

config = {
    # your normal configuration
    "dir_browser": {
      "enable": False
    },
}
app = WsgiDAVApp(config)

For more information

Note that an attacker cannot exploit this vulnerability, by simply uploading a file or folder with a manipulated file name. However if the WsgiDAV library is used in a scenario where untrusted data is displayed in the directory browser's user interface (e.g. 'realm' or user name, ...) XSS may happen.

If you have any questions or comments about this advisory:

Record
GHSA-xx6g-jj35-pxjv
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVPYSEC-2022-43018 No score

WsgiDAV is a generic and extendable WebDAV server based on WSGI. Implementations using this library with directory browsing enabled may be susceptible to Cross Site Scripting (XSS) attacks. This issue has been patched, users can upgrade to version 4.1.0. As a workaround, set dir_browser.enable = False in the configuration.

Record
PYSEC-2022-43018
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wsgidav
PyPI
 3.0.0a1 up to 4.1.0
4.1.0
wsgidav
PyPI
 3.0.0a1 up to 4.1.0, plus listed versions
3.0.03.0.0a23.0.0a33.0.0a43.0.0a5
Show 13 moreShow less
3.0.0a63.0.0a73.0.13.0.23.0.33.0.5a23.0.5a33.1.03.1.14.0.04.0.0a24.0.14.0.2
4.1.0
wsgidav
PyPI
 3.0.0 up to 4.1.0, plus listed versions
3.0.13.0.23.0.33.0.5a23.0.5a3
Show 6 moreShow less
3.1.03.1.14.0.04.0.0a24.0.14.0.2
4.1.0

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-41905 is a high vulnerability (CVSS 8.2) in Mar10 Wsgidav, published November 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in wsgidav 4.1.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open