Allocation of Resources Without Limits or Throttling Affecting wagtail package, versions [,7.0.8)[7.1rc1,7.3.3)[7.4rc1,7.4.2)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-WAGTAIL-17795996
- published2 Jul 2026
- disclosed1 Jul 2026
- credit0x1saac
Introduced: 1 Jul 2026
CVE-2026-54260 (opens in a new tab)How to fix?
Upgrade wagtail to version 7.0.8, 7.3.3, 7.4.2 or higher.
Overview
wagtail is an open source content management system built on Django.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the preview(request, image_id, filter_spec) view in wagtail/images/views/images.py. An authenticated admin can trigger expensive rendition processing by supplying crafted image filter specs in the image preview URL. The preview endpoint passes the requested filter_spec straight into Filter(spec=filter_spec).run(...), so unsupported or unbounded filter operations are processed before any restriction on allowed preview filters is applied. This can consume excessive CPU and memory during image rendition generation, degrading the admin experience and potentially slowing the site.
Notes
- The vulnerable path is the admin image preview URL, so it is only reachable by a user who can access the Wagtail admin and has permission to preview that image; ordinary site visitors are not in scope.
- The unbounded specs are accepted through the same preview syntax used by the built-in URL generator, so the affected behavior depends on deployments that expose that admin preview flow rather than any generic image-serving endpoint.