CVE-2026-54263

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54263
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54263.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54263
Aliases
Published
2026-07-01T21:12:30.719Z
Modified
2026-08-12T03:51:25.869546166Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Wagtail: Reflected XSS in dynamic image URL generator view
Details

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54263.json"
}
References

Affected packages

Git / github.com/wagtail/wagtail

Affected ranges

Type
GIT
Repo
https://github.com/wagtail/wagtail
Events
Introduced
0d3367a33ed4798b725afe653351a118270117e7
Fixed
7cc20a6071f54e59f90ce9bb746cbd6cdab1f4d9
Introduced
06237c56472b2cc2688dc9315e70a52962f67746
Fixed
213059f2472a78363098ba9f62e2cdcd3d91e649
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "7.3"
        },
        {
            "fixed": "7.3.3"
        },
        {
            "introduced": "7.4"
        },
        {
            "fixed": "7.4.2"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:torchbox:wagtail:*:*:*:*:*:*:*:*"
}

Affected versions

v7.*
v7.3
v7.3.1
v7.3.2
v7.4
v7.4.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54263.json"