---
id: "CVE-2026-129355"
page: "https://infrastack.ai/live/CVE-2026-129355"
kind: "vulnerability"
aliases: ["CVE-2026-129355"]
title: "dufs: WebDAV COPY handler flaw allows incorrect authorization remotely"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "dufs", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["dufs", "package", "self-hosted", "webdav"]
not_affected_if: ["local-only", "webdav-disabled"]
published_at: "2026-11-15T01:18:03+00:00"
first_seen_at: "2026-11-15T01:34:15+00:00"
updated_at: "2026-11-15T01:36:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129355", "first_seen_at": "2026-11-15T01:34:15+00:00"}]
exploit_sources: []
---

# dufs: WebDAV COPY handler flaw allows incorrect authorization remotely

Link for people: https://infrastack.ai/live/CVE-2026-129355 (this .md is for agents)

dufs is a small file server that supports WebDAV. A flaw in its WebDAV COPY operation handler lets a remote request bypass the intended authorization checks, so a caller can act on files they should not reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:dufs affected range not listed fixed no fixed version listed

## How to check

- Run `dufs --version` and confirm it is `0.46.0` or earlier.
- Check whether the server is reachable from the internet and whether WebDAV write access is enabled.

## Fix

- dufs: upgrade to `0.47.0`

## Timeline

- 2026-11-15T01:34:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129355

## Documents

- [fix] Patch: github.com https://github.com/sigoden/dufs/commit/fba13dffb9c65b5e5e26419f64de709200277a04

## From the sources

A vulnerability has been found in sigoden dufs up to 0.46.0. This affects an unknown part of the file src/server.rs of the component WebDAV COPY Operation Handler. The manipulation leads to incorrect authorization. The attack is possible to be carried out remotely. Upgrading to version 0.47.0 is able to mitigate this issue. The identifier of the patch is fba13dffb9c65b5e5e26419f64de709200277a04. It is advisable to upgrade the affected component.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_