CVE-2026-54259 Wagtail: Improper restriction handling on Documents and Images chosen endpoints

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, the Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could se...

CVE-2026-54260 Wagtail: Denial of service via unbounded filter specs in the image preview

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, an authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not...

CVE-2026-54260

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, an authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not...

CVE-2026-54260 Wagtail: Denial of service via unbounded filter specs in the image preview

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, an authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not...

CVE-2026-54260 Wagtail: Denial of service via unbounded filter specs in the image preview

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, an authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not...

CVE-2026-54260

CVE-2026-54260 affects Wagtail (Django-based CMS). In versions prior to 7.0.8, 7.3.3, and 7.4.2, an authenticated admin user can trigger expensive rendition processing via crafted filter specs in the image preview, leading to potential service degradation. This is not exploitable by anonymous vis...

ROOT-APP-PYPI-CVE-2024-39317 CVE-2024-39317 in rootio-wagtail - Patched by Root

Root has patched CVE-2024-39317 in the rootio-wagtail package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-44201 CVE-2026-44201 in rootio-wagtail - Patched by Root

Root has patched CVE-2026-44201 in the rootio-wagtail package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-44197 CVE-2026-44197 in rootio-wagtail - Patched by Root

Root has patched CVE-2026-44197 in the rootio-wagtail package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-28223 CVE-2026-28223 in rootio-wagtail - Patched by Root

Root has patched CVE-2026-28223 in the rootio-wagtail package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-44198 CVE-2026-44198 in rootio-wagtail - Patched by Root

Root has patched CVE-2026-44198 in the rootio-wagtail package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-44200 CVE-2026-44200 in rootio-wagtail - Patched by Root

Root has patched CVE-2026-44200 in the rootio-wagtail package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-28222 CVE-2026-28222 in rootio-wagtail - Patched by Root

Root has patched CVE-2026-28222 in the rootio-wagtail package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-44199 CVE-2026-44199 in rootio-wagtail - Patched by Root

Root has patched CVE-2026-44199 in the rootio-wagtail package for Root:PyPI. Multiple fixed versions available...

PT-2026-55566

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not...

PT-2026-55567

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. This issue has been fixed in...

PT-2026-54837

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 7.0.8 Wagtail versions prior to 7.3.3 Wagtail versions prior to 7.4.2 Description An authenticated admin user can cause service degradation by triggering expensive rendition processing using purposefully crafted filte...

CVE-2026-54261: Improper Handling of Insufficient Permissions or Privileges

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not...

PT-2026-55565

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, an authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not...

PT-2026-55564

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, the Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could se...