CVE-2026-129355

CVSS 6.9 (medium) · published 2026-11-15

A vulnerability has been found in sigoden dufs up to 0.46.0. This affects an unknown part of the file src/server.rs of the component WebDAV COPY Operation Handler. The manipulation leads to incorrect authorization. The attack is possible to be carried out remotely. Upgrading to version 0.47.0 is able to mitigate this issue. The identifier of the patch is fba13dffb9c65b5e5e26419f64de709200277a04. It is advisable to upgrade the affected component.

Weakness: CWE-285, CWE-863

Source: NVD CVE-2026-129355

References

• https://github.com/sigoden/dufs/
• https://github.com/sigoden/dufs/commit/fba13dffb9c65b5e5e26419f64de709200277a04
• https://github.com/sigoden/dufs/pull/753
• https://vuldb.com/cve/CVE-2026-129355
• https://vuldb.com/submit/1043822
• https://vuldb.com/vuln/437418
• https://vuldb.com/vuln/437418/cti

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.