CVE-2026-54263 Details
Description
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
A reflected cross-site scripting vulnerability has been identified in the Wagtail content management system, specifically in versions prior to 7.0.8, 7.3.3, and 7.4.2. The issue arises within the dynamic image URL generator view in the Wagtail admin interface. A user with a limited-permission editor account could craft a URL that, when accessed by a user with higher privileges, would execute actions using that user's credentials. This vulnerability affects all sites, regardless of whether the dynamic image serve view is enabled, and is not exploitable by regular site visitors without Wagtail admin access.
Users can upgrade to Wagtail versions 7.3.3 or 7.4.2 to address this vulnerability. For those unable to upgrade, a workaround involves disabling the vulnerable dynamic image preview functionality in the Wagtail admin by overriding the default URL pattern with a custom view that returns a bad request response.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wagtail/wagtail/security/advisories/GHSA-23m2-mghx-vqmf | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| torchbox wagtail | >= 7.3, < 7.3.3 >= 7.4, < 7.4.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 2, 2026 | Initial Analysis | [email protected] |
| Jul 1, 2026 | New CVE Received | [email protected] |