{"id":"CVE-2026-129355","kind":"vulnerability","aliases":["CVE-2026-129355"],"related":[],"title":"dufs: WebDAV COPY handler flaw allows incorrect authorization remotely","description":"A vulnerability has been found in sigoden dufs up to 0.46.0. This affects an unknown part of the file src/server.rs of the component WebDAV COPY Operation Handler. The manipulation leads to incorrect authorization. The attack is possible to be carried out remotely. Upgrading to version 0.47.0 is able to mitigate this issue. The identifier of the patch is fba13dffb9c65b5e5e26419f64de709200277a04. It is advisable to upgrade the affected component.","summary":"dufs is a small file server that supports WebDAV. A flaw in its WebDAV COPY operation handler lets a remote request bypass the intended authorization checks, so a caller can act on files they should not reach.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dufs","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dufs","package","self-hosted","webdav"],"not_affected_if":["local-only","webdav-disabled"],"how_to_check":"- Run `dufs --version` and confirm it is `0.46.0` or earlier.\n- Check whether the server is reachable from the internet and whether WebDAV write access is enabled.","fix":"- dufs: upgrade to `0.47.0`","status":"open","published_at":"2026-11-15T01:18:03+00:00","first_seen_at":"2026-11-15T01:34:15+00:00","triaged_at":"2026-11-15T01:36:00+00:00","updated_at":"2026-11-15T01:36:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-15T01:36:00Z","model":"claude-haiku-5-5","output":{"fix":"- dufs: upgrade to `0.47.0`","reach":"internet","title":"dufs: WebDAV COPY handler flaw allows incorrect authorization remotely","impact":"medium","summary":"dufs is a small file server that supports WebDAV. A flaw in its WebDAV COPY operation handler lets a remote request bypass the intended authorization checks, so a caller can act on files they should not reach.","audience":"developers","category":"package","nicknames":[],"who_cares":["dufs","webdav","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"remote callers get access to files they should be denied","analyst_note":"Confirm which authorization check the COPY handler skips and whether authentication is required, using the patch fba13dffb9c65b5e5e26419f64de709200277a04 on github.com.","how_to_check":"- Run `dufs --version` and confirm it is `0.46.0` or earlier.\n- Check whether the server is reachable from the internet and whether WebDAV write access is enabled.","plain_action":"","product_name":"dufs","needs_analyst":true,"not_affected_if":["webdav-disabled","local-only"],"who_is_affected":"Teams that run dufs with WebDAV enabled and reachable over the network are exposed. Installations where dufs is only used locally or without WebDAV can skip it. The sources do not say which authorization rules are bypassed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000735,"input_tokens":4617,"output_tokens":547,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129355':12A,15A '-2026':11A,14A '0.46.0':70C '0.47.0':105C 'abl':107C 'act':53B 'advis':121C 'affect':72C,125C 'allow':6A 'attack':94C 'author':8A,47B,92C 'bypass':44B 'caller':51B 'carri':99C 'check':48B 'compon':82C,126C 'copi':3A,37B,84C 'cve':10A,13A 'duf':1A,17B,23B,67C 'dufs':16A 'fba13dffb9c65b5e5e26419f64de709200277a04':118C 'file':27B,55B,78C 'flaw':5A,33B 'found':64C 'handler':4A,39B,86C 'host':21B 'identifi':113C 'incorrect':7A,91C 'intend':46B 'issu':111C 'lead':89C 'let':40B 'manipul':88C 'mitig':109C 'oper':38B,85C 'packag':18B 'part':75C 'patch':116C 'possibl':96C 'reach':59B 'remot':9A,42B,101C 'request':43B 'self':20B 'self-host':19B 'server':28B 'sigoden':66C 'small':26B 'src/server.rs':79C 'support':30B 'unknown':74C 'upgrad':102C,123C 'version':104C 'vulner':61C 'webdav':2A,22B,31B,36B,83C","nicknames":[],"mitigations":[],"who_affected":"Teams that run dufs with WebDAV enabled and reachable over the network are exposed. Installations where dufs is only used locally or without WebDAV can skip it. The sources do not say which authorization rules are bypassed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["dufs"],"ptokens":["dufs"],"labels":["dufs","medium","package","selfhosted","vendor","webdav"],"campaign_type":null,"search_a":"'-129355':12A,15A '-2026':11A,14A 'allow':6A 'author':8A 'copi':3A 'cve':10A,13A 'duf':1A 'dufs':16A 'flaw':5A 'handler':4A 'incorrect':7A 'remot':9A 'webdav':2A","search_b":"'act':53B 'author':47B 'bypass':44B 'caller':51B 'check':48B 'copi':37B 'duf':17B,23B 'file':27B,55B 'flaw':33B 'handler':39B 'host':21B 'intend':46B 'let':40B 'oper':38B 'packag':18B 'reach':59B 'remot':42B 'request':43B 'self':20B 'self-host':19B 'server':28B 'small':26B 'support':30B 'webdav':22B,31B,36B","search_c":"'0.46.0':70C '0.47.0':105C 'abl':107C 'advis':121C 'affect':72C,125C 'attack':94C 'author':92C 'carri':99C 'compon':82C,126C 'copi':84C 'duf':67C 'fba13dffb9c65b5e5e26419f64de709200277a04':118C 'file':78C 'found':64C 'handler':86C 'identifi':113C 'incorrect':91C 'issu':111C 'lead':89C 'manipul':88C 'mitig':109C 'oper':85C 'part':75C 'patch':116C 'possibl':96C 'remot':101C 'sigoden':66C 'src/server.rs':79C 'unknown':74C 'upgrad':102C,123C 'version':104C 'vulner':61C 'webdav':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T01:18:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129355","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129355","severity":null,"published_at":"2026-11-15T01:18:03+00:00","modified_at":"2026-11-15T01:18:03+00:00","first_seen_at":"2026-11-15T01:34:15+00:00","fetched_at":"2026-11-15T01:34:15+00:00","note":null}],"documents":[{"id":159860,"url":"https://github.com/sigoden/dufs/commit/fba13dffb9c65b5e5e26419f64de709200277a04","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}