Vulnerability Description
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Torchbox | Wagtail | < 7.0.8 |
Related Weaknesses (CWE)
References
- https://github.com/wagtail/wagtail/security/advisories/GHSA-r6p4-grq7-xm4mMitigationVendor Advisory
FAQ
What is CVE-2026-54261?
CVE-2026-54261 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, due to a missing permission check on the image preview endpoint, a user with access to...
How severe is CVE-2026-54261?
CVE-2026-54261 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-54261?
Check the references section above for vendor advisories and patch information. Affected products include: Torchbox Wagtail.