Executive brief
Wagtail is a Django-based content management system used to build and manage web applications. An authenticated admin user can craft malicious filter specifications to trigger expensive image processing operations, causing service slowdowns or outages. This vulnerability is only exploitable by users with admin panel access, not ordinary website visitors.
Technical details
This vulnerability is an uncontrolled resource consumption flaw (CWE-400) in Wagtail's image preview functionality. The vulnerable code lacks proper validation of image filter specifications, allowing an authenticated admin user to specify unbounded or computationally expensive filter operations that trigger resource-intensive rendition processing. The attack vector requires network access and low-privilege admin credentials; no user interaction is needed once authenticated. An attacker can degrade service availability by causing the application to consume excessive CPU and memory resources. Patches are available in Wagtail 7.0.8, 7.3.3, and 7.4.2; organizations unable to upgrade immediately can implement the provided workaround by validating filter operations against an allowlist.
Affected products
- Wagtail Wagtail < 7.0.8, >= 7.1 < 7.3.3, >= 7.4 < 7.4.2
Timeline
- 2026-06-15: disclosed: Published to GitHub Advisory Database
- 2026-06-15: patched: Patches released for Wagtail 7.0.8, 7.3.3, and 7.4.2
- 2026-08-20: advisory: Advisory published; CVE-2026-54260 assigned