Executive brief
Wagtail is a content management system and website builder used by organizations to manage web content. When an authenticated admin user uploads a file through the admin interface, Wagtail loads the entire file into memory for processing. An attacker with admin access could upload an extremely large file to consume all available memory, crashing the application and denying service to legitimate users. This requires privileged access, limiting exposure to trusted admin accounts.
Technical details
The vulnerability is an uncontrolled resource consumption (CWE-400/CWE-770) issue in Wagtail's file upload handling. When images or documents are uploaded through the admin interface, the entire file is loaded into memory for additional processing before size validation occurs. An authenticated admin user with permission to upload images or documents can trigger a denial-of-service by uploading a file large enough to exhaust server memory and crash the application. Default frontend validation of 10MB for images does not prevent the vulnerability, as the backend loads files before checking the limit. The attack requires authentication and privileged file-upload permissions. Patches are available in Wagtail 4.1.4 and 4.2.2.
Affected products
- Torchbox Wagtail < 4.1.4, 4.2, 4.2.1
Timeline
- 2023-04-03: disclosed
- 2023-04-03: patched: Wagtail 4.1.4 and 4.2.2