p PatchFirst

PatchFirst · Latest vulnerabilities

wagtail vulnerabilities

Vulnerabilities published for wagtail in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 30

  1. CVE-2026-55468

    Medium · CVSS 4.3EPSS 0.34%Fix available

    Wagtail: Improper restriction handling on Pages admin API

    Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

    wagtail wagtail wagtail wagtail wagtailPython
    • Update to 7.0.9
    • Update to 7.3.4
    • Update to 7.4.3
    • Update to 8.0rc2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. GHSA-jm5p-837g-rv8g

    Medium · CVSS 6.5Fix available

    Wagtail: Improper restriction handling on Page translation API endpoint

    ### Impact A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. ### Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. ### Workarounds N/A ### Acknowledgements Many thanks to tinyb0y for reporting this issue. ### For more information If you have any questions or comments about this advisory: * Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html) * Email us at [[email protected]](mailto:[email protected]) (view

    wagtail wagtail wagtail wagtailPython
    • Update to 7.0.9
    • Update to 7.3.4
    • Update to 7.4.3
    • Update to 8.0rc2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. GHSA-x5cx-w6p2-mxf2

    Medium · CVSS 6.5Fix available

    Wagtail: Improper permission handling when copying snippets

    ### Impact A CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. ### Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. ### Workarounds N/A ### Acknowledgements Many thanks to tinyb0y for reporting this issue. ### For more information If you have any questions or comments about this advisory: * Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html) * Email us at [[email protected]](mailto:[email protected]) (view our [security pol

    wagtail wagtail wagtail wagtailPython
    • Update to 7.0.9
    • Update to 7.3.4
    • Update to 7.4.3
    • Update to 8.0rc2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  4. GHSA-c2xx-cjmh-9q8f

    Medium · CVSS 5.3Fix available

    Wagtail: Improper restriction handling on descendant collections in Documents and Images API

    ### Impact The Documents and Images [API V2](https://docs.wagtail.org/en/stable/advanced_topics/api/index.html) incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections. ### Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. ### Workarounds Site owners using Wagtail's API can avoid the vulnerability by adding [authentication](https://docs.wagtail.org/en/stable/advanced_topics/api/v2/configuration.html#authenti

    wagtail wagtail wagtail wagtailPython
    • Update to 7.0.9
    • Update to 7.3.4
    • Update to 7.4.3
    • Update to 8.0rc2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. GHSA-92hv-j533-69wc

    Low · CVSS 3.7Fix available

    Wagtail: Identification of documents by SHA1 hash

    ### Impact By passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library. This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash. ### Patches Patched versions have been

    wagtail wagtail wagtail wagtailPython
    • Update to 7.0.9
    • Update to 7.3.4
    • Update to 7.4.3
    • Update to 8.0rc2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2026-54263

    High · CVSS 7.3EPSS 0.36%Fix available

    Wagtail: Reflected XSS in dynamic image URL generator view

    Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This is

    wagtail wagtail wagtailPython
    • Update to 7.3.3
    • Update to 7.4.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2026-54262

    Medium · CVSS 4.3EPSS 0.27%Fix available

    Wagtail: Pages translations can be created without page permissions when using simple_translation

    Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.

    wagtail wagtail wagtail wagtailPython
    • Update to 7.0.8
    • Update to 7.3.3
    • Update to 7.4.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2026-54261

    Medium · CVSS 6.5EPSS 0.34%Fix available

    Wagtail: Improper permission handling in image preview

    Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.

    wagtail wagtail wagtail wagtailPython
    • Update to 7.0.8
    • Update to 7.3.3
    • Update to 7.4.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2026-54259

    Medium · CVSS 4.3EPSS 0.27%Fix available

    Wagtail: Improper restriction handling on Documents and Images chosen endpoints

    Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, the Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.

    wagtail wagtail wagtail wagtailPython
    • Update to 7.0.8
    • Update to 7.3.3
    • Update to 7.4.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. CVE-2026-54260

    Medium · CVSS 4.3EPSS 0.37%Fix available

    Wagtail: Denial of service via unbounded filter specs in the image preview

    Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, an authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.

    wagtail wagtail wagtail wagtailPython
    • Update to 7.0.8
    • Update to 7.3.3
    • Update to 7.4.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  11. CVE-2026-44201

    Medium · CVSS 5.3EPSS 0.31%Fix available

    Wagtail: Improper restriction handling on Documents and Images API

    Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

    wagtail wagtail wagtailPython
    • Update to 7.0.7
    • Update to 7.3.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  12. CVE-2026-44200

    Medium · CVSS 6.5EPSS 0.34%Fix available

    Wagtail: Improper permission handling when copying pages

    Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

    wagtail wagtail wagtailPython
    • Update to 7.0.7
    • Update to 7.3.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  13. CVE-2026-44199

    Medium · CVSS 6.5EPSS 0.3%Fix available

    Wagtail: Improper permission handling when deleting form submissions

    Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

    wagtail wagtail wagtailPython
    • Update to 7.0.7
    • Update to 7.3.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  14. CVE-2026-44198

    Medium · CVSS 4.3EPSS 0.27%Fix available

    Wagtail: Improper permission handling when viewing page history

    Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

    wagtail wagtail wagtailPython
    • Update to 7.0.7
    • Update to 7.3.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  15. CVE-2026-44197

    Medium · CVSS 6.5EPSS 0.35%Fix available

    Wagtail: Improper permission handling when comparing revisions

    Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

    wagtail wagtail wagtailPython
    • Update to 7.0.7
    • Update to 7.3.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  16. CVE-2026-28222

    Medium · CVSS 6.1EPSS 0.63%Fix available

    Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes

    Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admi

    wagtail wagtail wagtail wagtail wagtailPython
    • Update to 6.3.8
    • Update to 7.0.6
    • Update to 7.2.3
    • Update to 7.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2026-28223

    Medium · CVSS 6.1EPSS 0.63%Fix available

    Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface

    Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in v

    wagtail wagtail wagtail wagtail wagtailPython
    • Update to 6.3.8
    • Update to 7.0.6
    • Update to 7.2.3
    • Update to 7.3.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2026-25517

    Medium · CVSS 5.1EPSS 0.49%Fix available

    Wagtail has improper permission handling on admin preview endpoints

    Wagtail is an open source content management system built on Django. Prior to versions 6.3.6, 7.0.4, 7.1.3, 7.2.2, and 7.3, due to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with ed

    wagtail wagtail wagtail wagtail wagtail wagtailPython
    • Update to 6.3.6
    • Update to 7.0.4
    • Update to 7.1.3
    • Update to 7.2.2
    • Update to 7.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. CVE-2024-39317

    Medium · CVSS 6.5EPSS 0.61%Fix available

    Wagtail regular expression denial-of-service via search query parsing

    Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, `parse_query_string` would take an unexpectedly large amount of time to process, resulting in a denial of service. In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses `parse_query_string`, it may be exploitable by other users (e.g. unauthent

    wagtail wagtail wagtail wagtailPython
    • Update to 5.2.6
    • Update to 6.0.6
    • Update to 6.1.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2024-35228

    Medium · CVSS 5.5EPSS 0.33%Fix available

    Improper Handling of Insufficient Permissions in Wagtail

    Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the `wagtail.contrib.settings` module, a user with access to the Wagtail admin and knowledge of the URL of the edit view for a settings model can access and update that setting, even when they have not been granted permission over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 6.0.5 and 6.1.2. Wagtail releases prior to 6.0 are unaffected. Users are advised to upgrade. Site owners who are unable to upgrade to a patch

    wagtail wagtail wagtailPython
    • Update to 6.0.5
    • Update to 6.1.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →