CVE-2026-54728

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54728
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54728.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54728
Aliases
  • GHSA-254j-92cv-m443
Published
2026-07-16T19:18:17.637Z
Modified
2026-07-19T03:31:10.527397781Z
Severity
  • 6.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
bunkerweb: Improper Input Validation and Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in BunkerWeb
Details

bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). Prior to BunkerWeb 1.6.12 and BunkerWeb PRO 0.57, authenticated Host header handling in the BunkerWeb UI and API improperly validated and neutralized user-controlled input in a configuration-dependent path, allowing a low-privileged authenticated user to escalate privileges and affect confidentiality, integrity, and availability of the BunkerWeb instance. This issue is fixed in BunkerWeb version 1.6.12 and BunkerWeb PRO version 0.57.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54728.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20",
        "CWE-74"
    ]
}
References

Affected packages

Git / github.com/bunkerity/bunkerweb

Affected ranges

Type
GIT
Repo
https://github.com/bunkerity/bunkerweb
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
685ccbbe7d204132a843a7b7fd802d1bdb3f20a9
Fixed
f035a1570bf38146340b2dce9161cfd63ba9a1cb
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.6.12"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.2.5
v1.2.6
v1.2.7
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.4.2
v1.5.0
v1.5.2
v1.5.3
v1.6.0
v1.6.1
v1.6.10
v1.6.11
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.6.7
v1.6.8
v1.6.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54728.json"