Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Wagtail versions before 7.0.8, from 7.1 before 7.3.3, and from 7.4 before 7.4.2 are affected. A user with access to the Wagtail admin can preview any image because of a missing permission check, though the image's stored data is not exposed and ordinary site visitors cannot exploit it. Upgrade to Wagtail 7.0.8, 7.3.3, or 7.4.2; sites that cannot upgrade can override the vulnerable view through a urls.py change described in the advisory.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 6.5 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0034, the 27th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:39 UTC First seen by agentprime
- 31 Oct 2026, 14:39 UTC Confirmed by OSV