Vulnerabilities for wagtail

First version without a known vulnerability: 7.4rc1

Details

• GHSA-jm5p-837g-rv8g2026-08-20

  Wagtail: Improper restriction handling on Page translation API endpoint

  Fixed in: 7.0.9, 7.3.4, 7.4.3, 8.0rc2

• GHSA-x5cx-w6p2-mxf22026-08-20

  Wagtail: Improper permission handling when copying snippets

  Fixed in: 7.0.9, 7.3.4, 7.4.3, 8.0rc2

• GHSA-c2xx-cjmh-9q8f2026-08-20

  Wagtail: Improper restriction handling on descendant collections in Documents and Images API

  Fixed in: 7.0.9, 7.3.4, 7.4.3, 8.0rc2

• GHSA-92hv-j533-69wc2026-08-20

  Wagtail: Identification of documents by SHA1 hash

  Fixed in: 7.0.9, 7.3.4, 7.4.3, 8.0rc2

• GHSA-3vrh-m9w7-v94f2026-08-20

  Wagtail: Improper restriction handling on Pages admin API

  Fixed in: 7.0.9, 7.3.4, 7.4.3, 8.0rc2

• GHSA-23m2-mghx-vqmf2026-08-20

  Wagtail: Reflected XSS in dynamic image URL generator view

  Fixed in: 7.3.3, 7.4.2

• GHSA-8634-mr4j-r72c2026-08-20

  Wagtail: Pages translations can be created without page permissions when using simple_translation

  Fixed in: 7.0.8, 7.3.3, 7.4.2

• GHSA-r6p4-grq7-xm4m2026-08-20

  Wagtail: Improper permission handling in image preview

  Fixed in: 7.0.8, 7.3.3, 7.4.2

• GHSA-f2p5-j6fg-5cxf2026-08-20

  Wagtail: Denial of service via unbounded filter specs in the image preview

  Fixed in: 7.0.8, 7.3.3, 7.4.2

• GHSA-h54r-xq46-qwqm2026-08-20

  Wagtail: Improper restriction handling on Documents and Images chosen endpoints

  Fixed in: 7.0.8, 7.3.3, 7.4.2

• GHSA-67rv-mg8q-5pf32026-05-08

  Wagtail has improper permission handling when copying pages

  Fixed in: 7.0.7, 7.3.2

• GHSA-p5gm-92h4-6pv62026-05-08

  Wagtail has improper restriction handling on Documents and Images API

  Fixed in: 7.0.7, 7.3.2

• GHSA-pwm3-7fv4-g6xx2026-05-08

  Wagtail has improper permission handling when deleting form submissions

  Fixed in: 7.0.7, 7.3.2

• GHSA-c4mr-889m-vgf62026-05-08

  Wagtail has improper permission handling when viewing page history

  Fixed in: 7.0.7, 7.3.2

• GHSA-c6wj-9vcj-75pj2026-05-08

  Wagtail has improper permission handling when comparing revisions

  Fixed in: 7.0.7, 7.3.2

• GHSA-p4v8-rw59-93cq2026-03-03

  Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface

  Fixed in: 6.3.8, 7.0.6, 7.2.3, 7.3.1

• GHSA-p5cm-246w-84jm2026-03-03

  Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes

  Fixed in: 6.3.8, 7.0.6, 7.2.3, 7.3.1

• GHSA-4qvv-g3vr-m3482026-02-03

  Wagtail has improper permission handling on admin preview endpoints

  Fixed in: 6.3.6, 7.0.4, 7.1.3, 7.2.2, 7.3

• GHSA-jmp3-39vp-fwg82024-07-11

  Wagtail regular expression denial-of-service via search query parsing

  Fixed in: 6.0.6, 6.1.3, 5.2.6, 31b1e8532dfb1b70d8d37d22aff9cbde9109cdf2, 3c941136f79c48446e3858df46e5b668d7f83797, b783c096b6d4fd2cfc05f9137a0be288850e99a2

• GHSA-xxfm-vmcf-g33f2024-06-02

  Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`

  Fixed in: 6.0.5, 6.1.2

• GHSA-w2v8-php4-p8hc2024-05-01

  Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`

  Fixed in: 6.0.3

• GHSA-fc75-58r8-rm3h2023-10-19

  Wagtail vulnerable to disclosure of user names via admin bulk action views

  Fixed in: 4.1.9, 5.0.5, 5.1.3, bc96aed6ac53f998b2f4c4bf97e2d4f5fe337e5b

• GHSA-33pv-vcgh-jfg92023-04-03

  Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files

  Fixed in: 4.2.2, 4.1.4, cfa11bbe00dbe7ce8cd4c0bbfe2a898a690df2bf, 3c0c64642b9e5b8d28b111263c7f4bddad6c3880, c9d2fcd650a88d76ae122646142245e5927a9165, d4022310cbe497993459c3136311467c7ac6329a

• GHSA-5286-f2rf-35c22023-04-03

  Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views

  Fixed in: 4.1.4, 4.2.2, eefc3381d37b476791610e5d30594fae443f33af, bc84bf9815610cfbf8db3b6050c7ddcbaa4b9713, 5be2b1ed55fd7259dfdf2c82e7701dba407b8b62, ff806ab173a504395fdfb3139eb0a29444ab4b91

• GHSA-xqxm-2rpm-38892022-01-21

  Comment reply notifications sent to incorrect users

  Fixed in: 2.15.2, 5fe901e5d86ed02dbbb63039a897582951266afd

• GHSA-xfrw-hxr5-ghqf2021-06-17

  Cross-site Scripting in wagtail

  Fixed in: 2.11.8, 2.12.5, 2.13.2

• GHSA-wq5h-f9p5-q7fx2021-04-20

  Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields

  Fixed in: 2.11.7, 2.12.4, 2.11.6

• GHSA-2473-9hgq-j7xw2020-07-20

  Cross-Site Scripting in Wagtail

  Fixed in: 2.9.3, 2.7.4, d9a41e7f24d08c024acc9a3094940199df94db34

• GHSA-jjjr-3jcw-f8v62020-05-07

  Potential Observable Timing Discrepancy in Wagtail

  Fixed in: 2.7.3, 2.8.2, 2.9

• GHSA-v2wc-pfq2-5cm62020-04-14

  Possible XSS attack in Wagtail

  Fixed in: 2.7.2, 2.8.1, 61045ceefea114c40ac4b680af58990dbe732389