Is CVE-2026-54260 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54260 being exploited in the wild.

How severe is CVE-2026-54260?

Medium severity, with a CVSS score of 4.3, published 1 July 2026.

Which products and versions are affected?

wagtail (PyPI) ECOSYSTEM:introduced=0,fixed=7.0.8, ECOSYSTEM:introduced=0,fixed=7.0.8,introduced=7.1,fixed=7.3.3,introduced=7.4,fixed=7.4.2; Wagtail = 7.1 = 7.4 < 7.4.2, < 7.0.8, 7.1.0 - 7.3.2, 7.4.0 - 7.4.1.

Is there a fix for CVE-2026-54260?

Yes. wagtail (PyPI): upgrade to 7.0.8, 7.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54260 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54260?

Check whether you run wagtail (PyPI) or Wagtail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54260: Wagtail denial of service via unbounded filter specs in image preview

Q: Is there a fix for CVE-2026-54260?

Yes. wagtail (PyPI): upgrade to 7.0.8, 7.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54260 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54260?

Check whether you run wagtail (PyPI) or Wagtail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54260 · Severity: medium · CVSS 4.3 · Published 2026-07-01

Wagtail is a Django-based content management system used to build and manage web applications. An authenticated admin user can craft malicious filter specifications to trigger expensive image processing operations, causing service slowdowns or outages. This vulnerability is only exploitable by users with admin panel access, not ordinary website visitors.

Technologies: wagtail (PyPI), Wagtail. Vendors: PyPI, Wagtail.

Quick answers

Is CVE-2026-54260 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54260 being exploited in the wild.
How severe is CVE-2026-54260?: Medium severity, with a CVSS score of 4.3, published 1 July 2026.
Which products and versions are affected?: wagtail (PyPI) ECOSYSTEM:introduced=0,fixed=7.0.8, ECOSYSTEM:introduced=0,fixed=7.0.8,introduced=7.1,fixed=7.3.3,introduced=7.4,fixed=7.4.2; Wagtail < 7.0.8, >= 7.1 < 7.3.3, >= 7.4 < 7.4.2, < 7.0.8, 7.1.0 - 7.3.2, 7.4.0 - 7.4.1.
Is there a fix for CVE-2026-54260?: Yes. wagtail (PyPI): upgrade to 7.0.8, 7.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54260 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54260?: Check whether you run wagtail (PyPI) or Wagtail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

wagtail (PyPI): upgrade to 7.0.8, 7.4.2 or later
```
pip install "wagtail>=7.4.2"
```

Technical details

This vulnerability is an uncontrolled resource consumption flaw (CWE-400) in Wagtail's image preview functionality. The vulnerable code lacks proper validation of image filter specifications, allowing an authenticated admin user to specify unbounded or computationally expensive filter operations that trigger resource-intensive rendition processing. The attack vector requires network access and low-privilege admin credentials; no user interaction is needed once authenticated. An attacker can degrade service availability by causing the application to consume excessive CPU and memory resources. Patches are available in Wagtail 7.0.8, 7.3.3, and 7.4.2; organizations unable to upgrade immediately can implement the provided workaround by validating filter operations against an allowlist.

Affected products

Wagtail Wagtail < 7.0.8, >= 7.1 < 7.3.3, >= 7.4 < 7.4.2

Identifiers

CVE-2026-54260
GHSA-f2p5-j6fg-5cxf
PYSEC-2026-613

Timeline

2026-06-15: disclosed: Published to GitHub Advisory Database
2026-06-15: patched: Patches released for Wagtail 7.0.8, 7.3.3, and 7.4.2
2026-08-20: advisory: Advisory published; CVE-2026-54260 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.