Executive brief
A security flaw exists in django-blog-zinnia, a popular blog management application for Django websites. When a user enters a password to access a protected blog post, the software stores that password in plain text within the user's session data. This could allow an attacker with access to the server's session storage or logs to see these passwords, potentially compromising private content.
Technical details
A cleartext storage vulnerability (CWE-312) exists in django-blog-zinnia up to version 0.20 within the Protected Entry Password Handler. Specifically, the file `zinnia/views/mixins/entry_protection.py` stores raw, submitted passwords directly into the Django session data after a visitor unlocks a protected entry. An attacker with local access to the session storage, database backups, or server logs could retrieve these passwords. The vulnerability stems from the application comparing the raw session-stored password against the entry password instead of using a secure authorization marker or cryptographic digest. As of the advisory date, the project has not yet released a patch.
Affected products
- Fantomas42 django-blog-zinnia up to 0.20
Timeline
- 2026-06-13: disclosed: Issue reported on GitHub repository
- 2026-07-19: advisory: CVE published by VulDB/NVD