WsgiDAV contains a blind SQL injection flaw in its sample MySQL provider. The flaw arises because the provider concatenates a request URL component directly into SQL WHERE clauses without sanitization. This can allow an attacker to inject SQL via a GET request and, if the share is publicly readable, to infer data through status codes and ultimately read arbitrary data that the configured MySQL account can access. The weakness corresponds to CWE‑89.

WsgiDAV, an extendable WebDAV server maintained by mar10, is affected. All releases before 4.3.5 are vulnerable, including 4.3.4 and earlier. The issue resides in the shipped example MySQLBrowserProvider which is not enabled by default; however, any deployment that explicitly configures this provider for a share is at risk.

The vulnerability scores a CVSS of 8.8, indicating a high severity. EPSS is not yet available, so the precise exploitation probability is unknown, but the lack of a KEV listing means no public exploits have been reported so far. The attack vector is a normal HTTP GET request to a WebDAV share that uses the vulnerable provider, which an unauthenticated client can reach if the share is publicly exposed. An attacker could use status‑code or timing comparisons to walk through the database and extract data.