CVE-2026-54263

Katalog CVE

CVSS 7.3 · High EPSS 0,36%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada torchbox wagtail. Skor CVSS 3.1 7.3 (High) menurut github.com.

Deskripsi (NVD)

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.

Rincian

Terbit di NVD

1 Juli 2026

Terakhir diubah

6 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.3 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wagtail/wagtail/security/advisories/GHSA-23m2-mghx-vqmf mitigasi · advisory vendor