Home
Glossary
WebDAV
Table of contents
5 min
H2 title on one or more lines.
Share
Updated on
June 22, 2026

What is Web Distributed Authoring and Versioning (WebDAV)?

WebDAV (Web Distributed Authoring and Versioning) is an extension of the HTTP protocol that lets users read and write files on a remote web server, not just download them. Standard HTTP treats a web server as a read-only source of content. WebDAV adds the ability to create, edit, move, copy, delete, and lock files remotely, effectively turning a web server into a shared file store that can be accessed over the same HTTP or HTTPS connection a browser uses. It is defined by RFC 4918, which replaced the original RFC 2518. WebDAV has been part of the web for decades and underpins familiar tools, including the calendar and contact protocols CalDAV and CardDAV, which are built on top of it. This page explains how WebDAV works, what it is used for, how it compares with alternatives such as FTP, and, because this is a security glossary, how attackers have learned to abuse a legitimate protocol to deliver malware.

Key takeaways

  • WebDAV is an HTTP extension for remote file management. It lets users author, edit, and organize files on a web server as if it were a network drive.
  • It adds new HTTP methods. Verbs such as PROPFIND, MKCOL, COPY, MOVE, and LOCK extend standard HTTP to support file operations and coordination.
  • It runs over HTTP and HTTPS. Because it uses ordinary web ports, WebDAV traffic usually passes through firewalls and proxies without special handling.
  • It powers CalDAV, CardDAV, and cloud storage. Many calendar, contact, and file-sync services are built on WebDAV or its extensions.
  • Attackers abuse it to deliver malware. Threat actors host payloads on WebDAV shares and lure users into opening them, which is why it appears in a security glossary.

How WebDAV works

WebDAV works by adding a set of new methods, or verbs, on top of the standard HTTP methods such as GET and POST. Where ordinary HTTP is designed mainly to retrieve content, these additional methods let a client manipulate files and folders on the server. Metadata and directory information travel as XML in the request and response bodies. The core WebDAV methods are below.

Method Purpose
PROPFIND Retrieve properties of a resource and list the contents of a collection (directory).
PROPPATCH Set or change properties on a resource in a single operation.
MKCOL Create a collection, which is the WebDAV term for a directory or folder.
COPY / MOVE Copy or move a resource to another location on the server.
LOCK / UNLOCK Lock a resource so only one person edits it at a time, then release it, avoiding the lost-update problem.

A client, which can be an application or the built-in file manager of an operating system, sends these requests to a WebDAV-enabled server. Standard HTTP authentication such as Basic or Digest controls who may use write methods like MKCOL, PUT, and DELETE, and running WebDAV over HTTPS encrypts the file content, metadata, and credentials in transit. Because everything travels over the normal web ports, 80 for HTTP and 443 for HTTPS, WebDAV usually passes through firewalls, proxies, and network address translation without special configuration. That convenience is also relevant to its security profile, as covered below.

What WebDAV is used for

WebDAV is a general-purpose way to manage remote files over the web, and it appears in more places than its name suggests:

  • Remote file access and collaboration. Teams edit and manage shared documents on a server without a separate file-transfer tool, with locking to prevent conflicting edits.
  • Mounting as a network drive. Operating systems can connect to a WebDAV server and present it like a local folder, so files open and save as if they were on the machine.
  • Cloud and self-hosted storage. Many file-sync and storage platforms, including self-hosted options such as Nextcloud and ownCloud, offer WebDAV access to their files.
  • Calendars and contacts. CalDAV and CardDAV, the standards behind much calendar and address-book synchronization, are extensions of WebDAV.
  • Content publishing. Authors and applications can publish or update content on a server directly, an early and enduring use of the protocol.

WebDAV compared with FTP and cloud storage

WebDAV is often weighed against older file-transfer methods and newer cloud services. Compared with FTP and SFTP, WebDAV has the advantage of running over standard web ports and HTTPS, so it is generally easier to pass through firewalls and secure with the same certificates a website uses, whereas FTP uses separate ports and SFTP runs over SSH. Compared with modern cloud-storage APIs and sync clients, WebDAV is an older, simpler, and more universal standard that many platforms still support, though dedicated cloud services often provide a smoother experience and richer features. WebDAV remains useful precisely because it is broadly supported and built directly on the web, but it is one option among several rather than the default choice it once was.

WebDAV and security: How attackers abuse it

WebDAV is a legitimate protocol, not a threat in itself. In a security context, though, it matters because attackers have increasingly used it as a way to deliver malware, and defenders need to understand why the technique works.

The core problem is trust and reach. Because WebDAV runs over ordinary HTTP and HTTPS, a connection to a remote WebDAV share can look like normal web traffic and often passes through the controls that would block other file-transfer methods. In campaigns documented from 2024 onward, attackers send a phishing message containing a shortcut file, typically a Windows internet shortcut with a .url extension or a shortcut with a .lnk extension. When opened, the shortcut connects to an attacker-controlled WebDAV share and pulls down a further file, and the chain continues through scripts to a final payload, frequently a remote access trojan. In some cases the Windows search-ms protocol handler is used to present the remote file in File Explorer as if it were a local search result, and attackers have hosted these WebDAV servers on abused tunneling services to avoid easy takedown.

What makes the technique effective is that it stages the payload outside the web browser, bypassing many browser-based download protections, and it uses a legitimate, native operating-system capability rather than an obvious exploit. Microsoft deprecated native WebDAV support in Windows File Explorer in late 2023, but the functionality still works on most systems, so the tactic remains viable. This does not make WebDAV malicious. It makes WebDAV a legitimate feature that organizations should monitor and, where they do not use it, consider disabling or restricting.

Defensive measures follow from this. On servers, WebDAV should be turned off where it is not needed, its write-capable methods restricted to authenticated users and specific directories, and it should always run over HTTPS. On endpoints and the network, security teams can monitor for the tell-tale chain of a shortcut file reaching out to an external WebDAV share, restrict outbound WebDAV connections to untrusted servers, and disable the native WebDAV client where it serves no business purpose.

Expert insight: A legitimate protocol as an attack path

WebDAV is a good example of a wider truth in security: many intrusions do not rely on malware exploiting a flaw, but on the misuse of features that are working exactly as designed. A shortcut opening a remote file share, a script running, a file downloading over HTTPS, each step is individually legitimate, which is precisely why the chain can slip past controls that look for obviously malicious actions. The signal is not any single event but the sequence: a document leading to an external WebDAV connection, leading to script execution, leading to an unfamiliar outbound connection.

That is where correlation across sources matters. Sekoia is a European cybersecurity vendor whose in-house Threat Detection & Research (TDR) team tracks delivery techniques like WebDAV abuse and the malware families that ride on them, and that intelligence feeds the platform. Rather than treating a WebDAV connection or a script launch as isolated noise, Sekoia's AI SOC platform correlates endpoint, network, and web signals and maps them to the MITRE ATT&CK framework, so that the staging chain behind a WebDAV-delivered payload can be recognized as one intrusion. To be clear about scope, Sekoia does not decide whether an organization should run WebDAV, which is an infrastructure and policy choice; what a CTI-led platform adds is the ability to tell benign use of the protocol apart from its abuse, based on behavior and current threat intelligence.