—

PYSEC-2026-1114

aliyundrive-webdav vulnerable to Command Injection

Details

An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid parameter in the `action_query_qrcode` component.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/aliyundrive-webdav

Introduced in: 0

No fixed version published yet for aliyundrive-webdav (pip). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-29640[ADVISORY]
https://github.com/lakemoon602/vuln/blob/main/detail.md[WEB]
https://github.com/messense/aliyundrive-webdav[PACKAGE]
https://github.com/messense/aliyundrive-webdav/blob/main/openwrt/luci-app-aliyundrive-webdav/luasrc/controller/aliyundrive-webdav.lua[WEB]
http://aliyundrive-webdav.com[WEB]
https://pypi.org/project/aliyundrive-webdav[PACKAGE]
https://github.com/advisories/GHSA-73v2-rxqp-7q4f[ADVISORY]