PyPI: wagtail
CVE-2026-54260
Safety vulnerability ID: SFTY-20260820-54356
Affected versions of the Wagtail package are vulnerable to Denial of Service (DoS) due to unbounded filter specifications in the image preview functionality. The `preview` view in the Wagtail admin allows authenticated admin users to supply arbitrary filter specifications, which can lead to expensive rendition processing and potential service degradation. An attacker with admin access can exploit this vulnerability by crafting filter specs that trigger excessive processing, potentially impacting server performance and availability.
Overview
Wagtail: Denial of service via unbounded filter specs in the image preview
Advisory
wagtail – Denial of Service (DoS)
Affected Package
Also affects
---
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260820-54356/CVE-2026-54260
- https://github.com/wagtail/wagtail/security/advisories/GHSA-f2p5-j6fg-5cxf
- https://nvd.nist.gov/vuln/detail/CVE-2026-54260
- https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2026-613.yaml
- https://github.com/advisories/GHSA-f2p5-j6fg-5cxf
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more