CVE-2026-54260 Details
Description
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, an authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
A denial-of-service vulnerability has been identified in Wagtail, an open-source content management system built on Django. This issue affects versions prior to 7.0.8, as well as 7.1 through 7.3.2 and 7.4 through 7.4.1. The vulnerability allows an authenticated admin user to trigger resource-intensive rendition processing by using carefully crafted filter specifications, which could lead to service degradation. Notably, this vulnerability cannot be exploited by regular site visitors without access to the Wagtail admin.
Users can upgrade to Wagtail versions 7.0.8, 7.3.3, or 7.4.2 to address this vulnerability. For those unable to upgrade, a patch can be applied by adding a custom view to 'urls.py' that validates filter specifications before processing image previews.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wagtail/wagtail/security/advisories/GHSA-f2p5-j6fg-5cxf | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| torchbox wagtail | < 7.0.8 >= 7.1, < 7.3.3 >= 7.4, < 7.4.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | Initial Analysis | [email protected] |
| Jul 2, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |