wagtail 6.0 vulnerabilities

Known vulnerabilities in the wagtail package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
H Regular Expression Denial of Service (ReDoS) wagtail is an open source content management system built on Django. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) through the `parse_query_string` process. An attacker can cause the server to consume excessive resources and potentially crash by submitting specially crafted search queries. Note: This is only exploitable if the site uses the default or a custom search implementation that employs `parse_query_string`. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `wagtail` to version 5.2.6, 6.0.6, 6.1.3 or higher.	[,5.2.6)[6.0,6.0.6)[6.1,6.1.3)
M Improper Handling of Insufficient Permissions or Privileges wagtail is an open source content management system built on Django. Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges in the `wagtail.contrib.settings` module. An attacker with access to the admin and knowledge of the URL of the edit view for a settings model can modify settings without proper permissions. How to fix Improper Handling of Insufficient Permissions or Privileges? Upgrade `wagtail` to version 6.0.5, 6.1.2 or higher.	[,6.0.5)[6.1rc1,6.1.2)
L Improper Authorization wagtail is an open source content management system built on Django. Affected versions of this package are vulnerable to Improper Authorization through `wagtail.contrib.settings` or `ModelViewSet` with restricted access configured via the `permission` argument on `FieldPanel`. An attacker with edit permissions on the model but not on specific fields can craft an HTTP POST request that bypasses the permission checks for individual fields, allowing unauthorized modification of their values. Note This issue does not affect ordinary site visitors without Wagtail admin access or users without edit permissions on the model. The editing interfaces for pages and snippets are also unaffected. How to fix Improper Authorization? Upgrade `wagtail` to version 6.0.3 or higher.	[6.0,6.0.3)

Vulnerability

Vulnerable Version

Regular Expression Denial of Service (ReDoS)

wagtail is an open source content management system built on Django.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) through the parse_query_string process. An attacker can cause the server to consume excessive resources and potentially crash by submitting specially crafted search queries.

Note: This is only exploitable if the site uses the default or a custom search implementation that employs parse_query_string.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade wagtail to version 5.2.6, 6.0.6, 6.1.3 or higher.

[,5.2.6)[6.0,6.0.6)[6.1,6.1.3)

Improper Handling of Insufficient Permissions or Privileges

wagtail is an open source content management system built on Django.

Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges in the wagtail.contrib.settings module. An attacker with access to the admin and knowledge of the URL of the edit view for a settings model can modify settings without proper permissions.

How to fix Improper Handling of Insufficient Permissions or Privileges?

Upgrade wagtail to version 6.0.5, 6.1.2 or higher.

[,6.0.5)[6.1rc1,6.1.2)

Improper Authorization

wagtail is an open source content management system built on Django.

Affected versions of this package are vulnerable to Improper Authorization through wagtail.contrib.settings or ModelViewSet with restricted access configured via the permission argument on FieldPanel.

An attacker with edit permissions on the model but not on specific fields can craft an HTTP POST request that bypasses the permission checks for individual fields, allowing unauthorized modification of their values.

Note

This issue does not affect ordinary site visitors without Wagtail admin access or users without edit permissions on the model. The editing interfaces for pages and snippets are also unaffected.

How to fix Improper Authorization?

Upgrade wagtail to version 6.0.3 or higher.

[6.0,6.0.3)

wagtail@6.0 vulnerabilities

A Django content management system.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

How to fix?