CVE-2026-125105

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-125105
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-125105.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-125105
Aliases
Published
2026-11-09T21:25:48Z
Modified
2026-11-10T10:47:14Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Wagtail: Identification of documents by SHA1 hash
Details

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, Wagtail applies ETag conditional request processing to the document serve endpoint before document permission and filename checks complete. An unauthenticated attacker who knows a document ID and a candidate SHA1 hash can submit If-Match or If-None-Match and distinguish the response, revealing whether that hash is present in the document library. The issue does not expose document contents, filenames, other metadata, or information about hashes the attacker does not already know. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-280"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125105.json"
}
References

Affected packages

Git / github.com/wagtail/wagtail

Affected ranges

Type
GIT
Repo
https://github.com/wagtail/wagtail
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ccbfe36634e10b0d7aa23ea3aa6eeed90a3e9948
Introduced
cf8c53ea06a1dea16fee8c2ca1cf76aa37e5e322
Fixed
9d7710deb65689246516663cdd096d336e238036
Introduced
06237c56472b2cc2688dc9315e70a52962f67746
Fixed
eceb34882b5e45bdf96c29222f574e9a506533a9
Introduced
8b3da7da3897302ac7838695c8457c7e13088b2a
Last Affected
8b3da7da3897302ac7838695c8457c7e13088b2a
Fixed
2db8a92ab888467bdd008b8e098c3d94d7da25f3
Fixed
a1402376889be87cfc413cf9f2694a547d2b77c7
Fixed
c4c38746855a562f451838fbfe0c77dab2c61829
Fixed
f05649908fb727035108194792fb5e4f9bb6c1b8
Fixed
cdaeb9907134e6d6df8648143aea39e901898b16
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "7.0.9"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "7.1"
                },
                {
                    "fixed": "7.3.4"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "7.4"
                },
                {
                    "fixed": "7.4.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "= 8.0rc1"
                },
                {
                    "last_affected": "= 8.0rc1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "fixed": "2db8a92ab888467bdd008b8e098c3d94d7da25f3"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "a1402376889be87cfc413cf9f2694a547d2b77c7"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "c4c38746855a562f451838fbfe0c77dab2c61829"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "f05649908fb727035108194792fb5e4f9bb6c1b8"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v7.0.9",
            "range": [
                {
                    "fixed": "ccbfe36634e10b0d7aa23ea3aa6eeed90a3e9948"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "v7.3.4",
            "range": [
                {
                    "fixed": "9d7710deb65689246516663cdd096d336e238036"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "v7.4.3",
            "range": [
                {
                    "fixed": "eceb34882b5e45bdf96c29222f574e9a506533a9"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "v8.0rc2",
            "range": [
                {
                    "fixed": "cdaeb9907134e6d6df8648143aea39e901898b16"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

= 8.*
= 8.0rc1
v0.*
v0.1
v0.2
v0.4
v0.5
v0.6
v0.7
v0.8
v0.8.1
v1.*
v1.0b2
v1.0rc1
v1.10rc1
v1.1rc1
v1.2rc1
v1.3rc1
v1.4rc1
v1.5rc1
v1.6rc1
v1.8rc1
v2.*
v2.11.rc1
v2.16rc1
v2.2rc1
v2.8rc1
v4.*
v4.1rc1
v7.*
v7.0
v7.0.1
v7.0.2
v7.0.3
v7.0.4
v7.0.5
v7.0.6
v7.0.7
v7.0.8
v7.0rc1
v7.3
v7.3.1
v7.3.2
v7.3.3
v7.3rc1
v7.4
v7.4.1
v7.4.2
v8.*
v8.0rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-125105.json"