{ "affected": [ { "ranges": [ { "database_specific": { "extracted_events": [ { "range": [ { "introduced": "0.1" }, { "last_affected": "0.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.2" }, { "last_affected": "0.2" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.3" }, { "last_affected": "0.3" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.4" }, { "last_affected": "0.4" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.5" }, { "last_affected": "0.5" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.6" }, { "last_affected": "0.6" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.7" }, { "last_affected": "0.7" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.8" }, { "last_affected": "0.8" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.9" }, { "last_affected": "0.9" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.10" }, { "last_affected": "0.10" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.11" }, { "last_affected": "0.11" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.12" }, { "last_affected": "0.12" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.13" }, { "last_affected": "0.13" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.14" }, { "last_affected": "0.14" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.15" }, { "last_affected": "0.15" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.16" }, { "last_affected": "0.16" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.17" }, { "last_affected": "0.17" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.18" }, { "last_affected": "0.18" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.19" }, { "last_affected": "0.19" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.20" }, { "last_affected": "0.20" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.21" }, { "last_affected": "0.21" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.22" }, { "last_affected": "0.22" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.23" }, { "last_affected": "0.23" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.24" }, { "last_affected": "0.24" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.25" }, { "last_affected": "0.25" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.26" }, { "last_affected": "0.26" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.27" }, { "last_affected": "0.27" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.28" }, { "last_affected": "0.28" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.29" }, { "last_affected": "0.29" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.30" }, { "last_affected": "0.30" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.31" }, { "last_affected": "0.31" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.32" }, { "last_affected": "0.32" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.33" }, { "last_affected": "0.33" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.34" }, { "last_affected": "0.34" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.35" }, { "last_affected": "0.35" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.36" }, { "last_affected": "0.36" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.37" }, { "last_affected": "0.37" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.38" }, { "last_affected": "0.38" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.39" }, { "last_affected": "0.39" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.40" }, { "last_affected": "0.40" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.41" }, { "last_affected": "0.41" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.42" }, { "last_affected": "0.42" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.43" }, { "last_affected": "0.43" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.44" }, { "last_affected": "0.44" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.45" }, { "last_affected": "0.45" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "introduced": "0.46.0" }, { "last_affected": "0.46.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" }, { "range": [ { "fixed": "fba13dffb9c65b5e5e26419f64de709200277a04" } ], "source": "REFERENCES_COMMIT" } ] }, "events": [ { "introduced": "63d780bd8915b00f6f31e7ad2bb498fc06d7d5f4" }, { "last_affected": "b69946df232ceca5d24d0067f2beb6b5ed1c292c" }, { "fixed": "fba13dffb9c65b5e5e26419f64de709200277a04" } ], "repo": "https://github.com/sigoden/dufs", "type": "GIT" } ], "versions": [ "0.1", "0.10", "0.11", "0.12", "0.13", "0.14", "0.15", "0.16", "0.17", "0.18", "0.19", "0.2", "0.20", "0.21", "0.22", "0.23", "0.24", "0.25", "0.26", "0.27", "0.28", "0.29", "0.3", "0.30", "0.31", "0.32", "0.33", "0.34", "0.35", "0.36", "0.37", "0.38", "0.39", "0.4", "0.40", "0.41", "0.42", "0.43", "0.44", "0.45", "0.46.0", "0.5", "0.6", "0.7", "0.8", "0.9" ] } ], "database_specific": { "cna_assigner": "VulDB", "cwe_ids": [ "CWE-285", "CWE-863" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129355.json" }, "details": "A vulnerability has been found in sigoden dufs up to 0.46.0. This affects an unknown part of the file src/server.rs of the component WebDAV COPY Operation Handler. The manipulation leads to incorrect authorization. The attack is possible to be carried out remotely. Upgrading to version 0.47.0 is able to mitigate this issue. The identifier of the patch is fba13dffb9c65b5e5e26419f64de709200277a04. It is advisable to upgrade the affected component.", "id": "CVE-2026-129355", "modified": "2026-11-15T10:30:21.725401309Z", "published": "2026-11-15T01:00:26.308Z", "references": [ { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/129xxx/CVE-2026-129355.json" }, { "type": "WEB", "url": "https://github.com/sigoden/dufs/" }, { "type": "FIX", "url": "https://github.com/sigoden/dufs/commit/fba13dffb9c65b5e5e26419f64de709200277a04" }, { "type": "FIX", "url": "https://github.com/sigoden/dufs/pull/753" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129355" }, { "type": "ADVISORY", "url": "https://vuldb.com/cve/CVE-2026-129355" }, { "type": "ADVISORY", "url": "https://vuldb.com/submit/1043822" }, { "type": "ADVISORY", "url": "https://vuldb.com/vuln/437418" }, { "type": "REPORT", "url": "https://vuldb.com/vuln/437418/cti" } ], "schema_version": "1.9.2", "severity": [ { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "type": "CVSS_V4" } ], "summary": "sigoden dufs WebDAV COPY Operation server.rs authorization" }