CVE-2026-40162

Katalog CVE

CVSS 7.1 · High EPSS 0,51%

Kerentanan Improper Input Validation pada bugsink. Skor CVSS 3.1 7.1 (High) menurut github.com.

Deskripsi (NVD)

Bugsink is a self-hosted error tracking tool. In 2.1.0, an authenticated file write vulnerability was identified in Bugsink 2.1.0 in the artifact bundle assembly flow. A user with a valid authentication token could cause the application to write attacker-controlled content to a filesystem location writable by the Bugsink process. This vulnerability is fixed in 2.1.1.

Rincian

Terbit di NVD

10 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bugsink/bugsink/security/advisories/GHSA-8hw4-fhww-273g mitigasi · advisory vendor
• https://github.com/bugsink/bugsink/releases/tag/2.1.1 product · release notes