CVE-2026-88136

Executive Summary

CVE-2026-88136 is an improper path equivalence resolution vulnerability in a WebDAV implementation (CWE-41) that allows an authenticated, low-privileged attacker to execute code remotely over the network. The CVSS v3.1 base score is 8.8 (High), reflecting network reachability, low attack complexity, and full loss of confidentiality, integrity, and availability within the affected component's security scope. No vendor, product, affected version range, public proof-of-concept, or patch has been identified, so defenders must treat the affected surface as unpatched and rely on segmentation, authentication hardening, and behavioral detection.

Technical Analysis

The root cause is classified as CWE-41: Improper Resolution of Path Equivalence. This weakness class occurs when software applies authorization, filtering, or dispatch logic to one representation of a path while subsequently operating on a logically equivalent but syntactically different representation. WebDAV is a path-oriented protocol (methods such as PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, PUT, and DELETE operate on URI paths), which makes it an inherently relevant attack surface for this weakness class: a request path can be normalized, decoded, or collapsed differently by a proxy, an authentication layer, and the backend file or handler resolver, producing a mismatch between the resource that was authorized and the resource that is ultimately acted upon.

The consequence stated in the NVD description is code execution, not merely file disclosure. At the vulnerability-class level, this means that a path equivalence mismatch can be leveraged to reach a resource or handler that the attacker's credentials should not permit — for example, by causing a security-relevant path check to be evaluated against one canonical form while the underlying file operation or handler dispatch resolves to another. Because the CVSS vector indicates PR:L (low privileges required), the attacker is assumed to already hold a valid, authorized-but-limited account on the WebDAV service; the flaw is an authorization/deconfliction bypass rather than a pre-authentication one.

No function names, class names, URL endpoints, file paths, or API parameters are provided in the CNA or NVD data, and no CNA title was supplied. Accordingly, this report deliberately does not name specific handlers, normalization routines, or endpoint paths. The precise normalization sequence (for example, which layer applies the equivalence and which layer acts on it) is not derivable from the available data and must be confirmed against the actual product once the vendor is identified.

Attack surface summary:

• Protocol: WebDAV over HTTP/HTTPS, reachable on the network (AV:N).
• Precondition: a valid low-privileged principal (PR:L); no user interaction is required (UI:N).
• Complexity: low (AC:L) — the vector does not require specialized conditions or a race.
• Security scope: unchanged (S:U) — impact is confined to the vulnerable component's authority, but within that scope, confidentiality, integrity, and availability are all High (C:H/I:H/A:H).

Exploitation Scenarios

Note: no public PoC is available; the following attack chain is inferred strictly from the vulnerability class (CWE-41) and the stated impact (code execution over a network by an authorized attacker). It does not assert product-specific paths, methods, or parameters beyond those that are generic to the WebDAV protocol.

1. Reconnaissance and target identification. The attacker identifies an internet- or intranet-exposed WebDAV service and confirms it supports WebDAV semantics (for example, DAV-capable responses to the OPTIONS method). The attacker then obtains or is already in possession of valid low-privileged credentials, consistent with the PR:L vector. Target selection can be informed by banner/service fingerprints on HTTP(S) ports.

2. Triggering the path equivalence flaw. Using its authorized credentials, the attacker issues WebDAV requests whose path representations are logically equivalent but syntactically distinct from a protected resource. The objective is to cause the authorization or filter check to evaluate one canonical form while the resource resolution or handler dispatch acts on the other. This is the defining mechanism of CWE-41 and does not require the attacker to possess privileges for the protected resource itself.

3. Payload and execution. Because the stated outcome is code execution, the attacker leverages the resulting path/authorization mismatch to reach a resource or code path that its privilege level should not permit, up to and including execution of attacker-influenced content. The exact delivery mechanism (upload-and-invoke, handler redirection, or similar) cannot be specified from the available data and is therefore described only at the class level: the mismatch converts a limited account into the ability to influence code that the server then executes, over the network.

4. Post-exploitation impact. Given C:H/I:H/A:H within the component's scope, successful exploitation can result in full read/write access to exposed data and execution of arbitrary logic under the context of the WebDAV service. That typically translates to data theft, tampering, service disruption, and — depending on the service's host privileges — a foothold for lateral movement.

Because POC_STATUS is None and no Nuclei template, exploit code, or OSV package data exists, there is no confirmed in-the-wild exploitation evidence and no public tooling to attribute.

Impact Assessment

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 8.8 (High). Subscore interpretation:

• AV:N — exploitable across a network, so any reachable WebDAV endpoint is exposed.
• AC:L — no unusual conditions are required; exploitation is repeatable.
• PR:L — the attacker needs any valid low-privileged account, materially lowering the bar in environments with self-registration, shared service accounts, or many user accounts.
• UI:N — no victim action is required.
• S:U — impact stays within the vulnerable component's security authority.
• C:H/I:H/A:H — full loss of confidentiality, integrity, and availability within that scope, consistent with remote code execution.

Business impact: systems hosting the affected WebDAV service may be fully compromised at the application level, enabling data exfiltration, integrity loss of stored content, and denial of service. Blast radius is bounded by deployment: internet-facing services are the highest risk; internal file-collaboration or document-management deployments are also exposed to any authenticated user. Absence of a patch, workaround, and known affected-version list means asset owners cannot currently scope exposure by version — inventory by service fingerprint (WebDAV enabled) is required. No EPSS score has been assigned by FIRST.org, so no exploit-likelihood prior is available; CISA KEV does not list this CVE and no threat actor campaign is referenced.

Detection Guidance

Detection strategy focuses on anomalous WebDAV path handling: requests using non-canonical or equivalent-but-distinct path forms, unusual HTTP methods (PROPFIND, PROPPATCH, MKCOL, COPY, MOVE), and returns indicating successful access to resources outside the caller's normal scope. Because the vendor is unknown, the rules below are intentionally generic and lean on WebDAV protocol behavior rather than product-specific artifacts. Tune method lists and path patterns to the environment.

Sigma Rule

title: Suspicious WebDAV Non-Canonical Path Access (CVE-2026-88136)
id: 8f2b1c7e-3a44-4d9b-9e21-7c0d5a6b8813
status: experimental
description: Detects WebDAV requests using non-canonical or path-equivalent traversal sequences that may indicate CWE-41 path equivalence abuse leading to code execution.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88136
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - 'PROPFIND'
      - 'PROPPATCH'
      - 'MKCOL'
      - 'COPY'
      - 'MOVE'
      - 'PUT'
  selection_path:
    cs-uri-stem|contains:
      - '/./'
      - '/../'
      - '..%2f'
      - '%2e%2e'
      - '//'
      - '%252e'
  condition: selection_method and selection_path
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - sc-status
falsepositives:
  - Misconfigured WebDAV clients emitting unnormalized paths
  - Legacy applications using // in paths
level: high

YARA Rule

rule CVE_2026_88136_WebDAV_Path_Equivalence
{
    meta:
        description = "Detects WebDAV requests abusing path equivalence (CWE-41) consistent with CVE-2026-88136"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88136"
        date = "2026-01-01"
        severity = "high"

    strings:
        $m1 = "PROPFIND" ascii wide nocase
        $m2 = "PROPPATCH" ascii wide nocase
        $m3 = "MKCOL" ascii wide nocase
        $m4 = "MOVE" ascii wide nocase
        $p1 = "/./" ascii
        $p2 = "/../" ascii
        $p3 = "..%2f" ascii nocase
        $p4 = "%2e%2e" ascii nocase
        $p5 = "%252e" ascii nocase

    condition:
        uint16(0) != 0x5A4D and
        any of ($m1, $m2, $m3, $m4) and
        any of ($p1, $p2, $p3, $p4, $p5)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-88136 WebDAV Path Equivalence Abuse Attempt"; flow:established,to_server; http.method; content:"PROPFIND"; nocase; http.uri; content:"/../"; http.uri; content:"..%2f"; nocase; http.uri; content:"%2e%2e"; nocase; sid:90088136; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-88136, reference nvd.nist.gov/vuln/detail/CVE-2026-88136; classtype:web-application-attack;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method in ("PROPFIND","PROPPATCH","MKCOL","COPY","MOVE","PUT")
     and wildcard(http.request.uri, "*/../*")]
  [network where http.request.method in ("PROPFIND","PROPPATCH","MKCOL","COPY","MOVE","PUT")
     and wildcard(http.request.uri, "*..%2f*")]

Splunk SPL Query

index=web sourcetype=access_combined
| eval method=upper(cs_method)
| where method IN ("PROPFIND","PROPPATCH","MKCOL","COPY","MOVE","PUT")
| where match(uri, "(?i)(/\\./|/\\.\\./|\\.\\.%2f|%2e%2e|%252e|//)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, method
| where count >= 3
| sort - count

Wazuh OSSEC Rule

<group name="web,webdav,cve-2026-88136,">
  <rule id="100813" level="12">
    <if_sid>31100</if_sid>
    <regex>(PROPFIND|PROPPATCH|MKCOL|COPY|MOVE) .*(/\./|/\.\./|\.\.%2f|%2e%2e|%252e)</regex>
    <description>CVE-2026-88136: WebDAV request with non-canonical/equivalence path - possible CWE-41 abuse</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range has been published; the rules below are compensating controls, not remediations.

1. Immediate mitigations

• Disable or restrict WebDAV where it is not required. Where required, place it behind authentication and limit exposure to trusted networks rather than the public internet.
• Enforce canonicalization and normalization at the edge: reject requests containing encoded or duplicated traversal sequences (for example %2e%2e, %252e, //, /./) before they reach the WebDAV handler; use a reverse proxy that normalizes paths to a single canonical form prior to authorization.
• Apply strict, unified authorization on the normalized path so that the checked path and the acted-upon path are provably identical.
• Reduce the value of the required low-privilege account: remove shared/service accounts with WebDAV access, enforce least privilege, and monitor for anomalous use of any such account.
• Restrict execution: ensure directories reachable and writable via WebDAV cannot serve or execute code (disable script execution and dynamic handlers in those locations).

2. Patch/upgrade steps

• No fixed version is known. Until a vendor advisory is published, track the affected product by service fingerprint (WebDAV enabled) rather than by version.
• Once the vendor is identified and an advisory or fixed version is released, treat this as a high-severity RCE (CVSS 8.8) and prioritize upgrade on internet-facing and multi-tenant systems.
• Maintain an asset inventory of WebDAV-enabled services so remediation can be applied the moment a fixed build is available.

3. Long-term hardening

• Adopt a single canonicalization function for all path handling and ensure authorization, dispatch, and file operations reference that single canonical form (directly addresses CWE-41).
• Deploy the detection content above (webserver, network, and host layers) and tune false positives from legitimate legacy clients.
• Segment WebDAV services from sensitive data stores and from hosts with execution privileges to contain the S:U scope of impact.
• Add CVE-2026-88136 to vulnerability-management tracking and re-check for a vendor advisory, EPSS score, and CISA KEV listing on a recurring basis.

References

• NVD — CVE-2026-88136: https://nvd.nist.gov/vuln/detail/CVE-2026-88136
• MITRE CWE-41 — Improper Resolution of Path Equivalence: https://cwe.mitre.org/data/definitions/41.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS: https://www.first.org/epss/ (no score currently assigned for this CVE)
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE not listed)

Note: No vendor advisory, researcher blog, public proof-of-concept, Nuclei template, exploit code, OSV package record, or threat-actor campaign is referenced in the available data. No exploit-in-the-wild evidence exists for this CVE at the time of writing.