EUVD-2026-41150

Wagtail: Reflected XSS in dynamic image URL generator view...

GHSA-23M2-MGHX-VQMF Wagtail: Reflected XSS in dynamic image URL generator view

Impact A reflected cross-site scripting XSS vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform...

Wagtail: Reflected XSS in dynamic image URL generator view

Impact A reflected cross-site scripting XSS vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform...

wagtail-sb-admin-interface (>=0.6.0, <=0.7.0), wagtail-sb-codefield (0.4.0) +4 more potentially affected by CVE-2026-54262 via wagtail (6.0.0rc1)

wagtail PYPI version 6.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-sb-admin-interface =0.6.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2026-54262 Source advisory: OSV:GHSA-8634-MR4J-R72C...

wagtail-sb-admin-interface (>=0.6.0, <=0.7.0), wagtail-sb-codefield (0.4.0) +4 more potentially affected by CVE-2026-54261 via wagtail (6.0.0rc1)

wagtail PYPI version 6.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-sb-admin-interface =0.6.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2026-54261 Source advisory: OSV:GHSA-R6P4-GRQ7-XM4M...

EUVD-2026-41148

Wagtail: Improper permission handling in image preview...

Wagtail: Improper permission handling in image preview

Impact Due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin...

GHSA-R6P4-GRQ7-XM4M Wagtail: Improper permission handling in image preview

Impact Due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin...

EUVD-2026-41146

Wagtail: Denial of service via unbounded filter specs in the image preview...

coop (>=2.12.0, <=2.12.6), meine-stadt-transparent (0.2.12) +7 more potentially affected by CVE-2026-54260 via wagtail (2.12.6)

wagtail PYPI version 2.12.6 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coop =2.12.0, =0.2.0, =0.10.2, =0.11.0 - wagtail-nav-menus 3.5.0 - wagtail-tag-manager 0.25.1 - wagtailstreamforms 3.14.0 Source cves:...

wagtail-sb-admin-interface (>=0.0.0, <=0.5.0), wagtail-sb-codefield (>=0.1.0, <=0.3.0) +2 more potentially affected by CVE-2026-54260 via wagtail (5.0.0rc1)

wagtail PYPI version 5.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-sb-admin-interface =0.0.0, =0.1.0, =0.1.0, =0.4.0, =0.6.0 Source cves: CVE-2026-54260 Source advisory: OSV:GHSA-F2P5-J6FG-5CXF...

coop (>=2.12.0, <=2.12.6), meine-stadt-transparent (0.2.12) +7 more potentially affected by CVE-2026-54259 via wagtail (2.12.6)

wagtail PYPI version 2.12.6 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coop =2.12.0, =0.2.0, =0.10.2, =0.11.0 - wagtail-nav-menus 3.5.0 - wagtail-tag-manager 0.25.1 - wagtailstreamforms 3.14.0 Source cves:...

wagtail-sb-admin-interface (>=0.0.0, <=0.5.0), wagtail-sb-codefield (>=0.1.0, <=0.3.0) +2 more potentially affected by CVE-2026-54259 via wagtail (5.0.0rc1)

wagtail PYPI version 5.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-sb-admin-interface =0.0.0, =0.1.0, =0.1.0, =0.4.0, =0.6.0 Source cves: CVE-2026-54259 Source advisory: OSV:GHSA-H54R-XQ46-QWQM...

GHSA-H54R-XQ46-QWQM Wagtail: Improper restriction handling on Documents and Images chosen endpoints

Impact The Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not...

Wagtail: Improper restriction handling on Documents and Images chosen endpoints

Impact The Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not...

EUVD-2026-41147

Wagtail: Improper restriction handling on Documents and Images chosen endpoints...

GHSA-8HW4-7QJR-3WXG Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

Summary SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles — only verifies that the submitted value starts with the string data:image. The MIME subtype and the base64-decoded bytes are never inspected or validated. A related bug in FileNameGenerator causes the...

GHSA-V667-GC2R-2XM7 Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication

Summary The init guard middleware in Qinglong only checks /api/user/init paths but not /open/user/init, which is whitelisted from JWT authentication and rewritten to /api/user/init after the guard has already passed, allowing unauthenticated admin credential reset on initialized instances. Affect...

EUVD-2026-44820

Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication...

Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication

Summary The init guard middleware in Qinglong only checks /api/user/init paths but not /open/user/init, which is whitelisted from JWT authentication and rewritten to /api/user/init after the guard has already passed, allowing unauthenticated admin credential reset on initialized instances. Affect...