DUFS · CVE-2026-129355 · Package
NO FIX YET · SEE WHAT TO DO
dufs is a small file server that supports WebDAV. A flaw in its WebDAV COPY operation handler lets a remote request bypass the intended authorization checks, so a caller can act on files they should not reach.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run dufs with WebDAV enabled and reachable over the network are exposed. Installations where dufs is only used locally or without WebDAV can skip it. The sources do not say which authorization rules are bypassed.
Not affected if local-only, webdav-disabled
Who cares dufs, self-hosted, webdav
dufs --version and confirm it is 0.46.0 or earlier.0.47.0A vulnerability has been found in sigoden dufs up to 0.46.0. This affects an unknown part of the file src/server.rs of the component WebDAV COPY Operation Handler. The manipulation leads to incorrect authorization. The attack is possible to be carried out remotely. Upgrading to version 0.47.0 is able to mitigate this issue. The identifier of the patch is fba13dffb9c65b5e5e26419f64de709200277a04. It is advisable to upgrade the affected component.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.