A WebDAV request path containing an encoded parent-directory segment can bypass the configured filesystem share root. This enables an attacker to read or write files outside the intended directory, compromising confidentiality, integrity, and potentially availability of the file system. The flaw is based on improper validation of encoded path components (CWE-22).

The vulnerability affects the WsgiDAV WebDAV server developed by Mar10. Versions 4.3.3 and earlier are impacted; the issue is resolved in 4.3.4 and later releases.

The CVSS score of 7.1 indicates high severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be network-based via WebDAV requests, and an attacker with network access to the server could exploit the flaw without additional authentication if the WebDAV service is exposed.