Executive brief
Bugsink path traversal via event_id in ingestion
Affected products
- PyPI bugsink
Junglewise Threat Intelligence
CVE-2025-54433: PYSEC-2026-1226 - Bugsink path traversal via event_id in ingestion
CVE-2025-54433 · Severity: medium · CVSS 4 · Published 2026-07-07
Technologies: bugsink (PyPI). Vendors: PyPI.
Related threats
- Bugsink denial of service via excessive event tags
- PYSEC-2026-1227 - Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)
- PYSEC-2026-1225 - Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input
- PYSEC-2026-301 - Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering
- Bugsink missing project scoping in sourcemap and debug file lookup