Homepage
About Snyk

wagtail@5.0.4 vulnerabilities

A Django content management system.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the wagtail package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Improper Handling of Insufficient Permissions or Privileges

wagtail is an open source content management system built on Django.

Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges in the wagtail.contrib.settings module. An attacker with access to the admin and knowledge of the URL of the edit view for a settings model can modify settings without proper permissions.

How to fix Improper Handling of Insufficient Permissions or Privileges?

Upgrade wagtail to version 6.0.5, 6.1.2 or higher.

[,6.0.5) [6.1rc1,6.1.2)
  • L
Race Condition

wagtail is an open source content management system built on Django.

Affected versions of this package are vulnerable to Race Condition in dispatch() in edit.py, when two processes load the edit view of a page without a subscription.

How to fix Race Condition?

Upgrade wagtail to version 5.2rc1 or higher.

[,5.2rc1)
  • L
Race Condition

wagtail is an open source content management system built on Django.

Affected versions of this package are vulnerable to Race Condition in create_or_update_for_object() that could cause uniqueness errors when inserting reference index entries.

How to fix Race Condition?

Upgrade wagtail to version 5.2rc1 or higher.

[,5.2rc1)
  • L
Direct Request ('Forced Browsing')

wagtail is an open source content management system built on Django.

Affected versions of this package are vulnerable to Direct Request ('Forced Browsing') through the admin bulk action views. An attacker can disclose user names by making a direct URL request.

Note:

This is only exploitable if the attacker has a limited-permission editor account for the Wagtail admin.

How to fix Direct Request ('Forced Browsing')?

Upgrade wagtail to version 4.1.9, 5.0.5, 5.1.3 or higher.

[,4.1.9) [4.2,5.0.5) [5.1,5.1.3)
Go back to all versions of this package