# CVE-2026-54260: Wagtail denial of service via unbounded filter specs in image preview

Source: https://junglewise.ai/threats/cve-2026-54260-wagtail-denial-of-service-via-unbounded-filter-specs-in-image  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54260 · Severity: medium · CVSS 4.3 · Published 2026-07-01

Wagtail is a Django-based content management system used to build and manage web applications. An authenticated admin user can craft malicious filter specifications to trigger expensive image processing operations, causing service slowdowns or outages. This vulnerability is only exploitable by users with admin panel access, not ordinary website visitors.

Technologies: [wagtail (PyPI)](https://junglewise.ai/threats/technologies/pypi-wagtail), [Wagtail](https://junglewise.ai/threats/technologies/wagtail). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Wagtail](https://junglewise.ai/threats/vendors/wagtail).

## Quick answers

**Is CVE-2026-54260 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54260 being exploited in the wild.

**How severe is CVE-2026-54260?** Medium severity, with a CVSS score of 4.3, published 1 July 2026.

**Which products and versions are affected?** wagtail (PyPI) ECOSYSTEM:introduced=0,fixed=7.0.8, ECOSYSTEM:introduced=0,fixed=7.0.8,introduced=7.1,fixed=7.3.3,introduced=7.4,fixed=7.4.2; Wagtail < 7.0.8, >= 7.1 < 7.3.3, >= 7.4 < 7.4.2, < 7.0.8, 7.1.0 - 7.3.2, 7.4.0 - 7.4.1.

**Is there a fix for CVE-2026-54260?** Yes. wagtail (PyPI): upgrade to 7.0.8, 7.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54260 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54260?** Check whether you run wagtail (PyPI) or Wagtail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- wagtail (PyPI): upgrade to 7.0.8, 7.4.2 or later

  ```sh
  pip install "wagtail>=7.4.2"
  ```


## Technical details

This vulnerability is an uncontrolled resource consumption flaw (CWE-400) in Wagtail's image preview functionality. The vulnerable code lacks proper validation of image filter specifications, allowing an authenticated admin user to specify unbounded or computationally expensive filter operations that trigger resource-intensive rendition processing. The attack vector requires network access and low-privilege admin credentials; no user interaction is needed once authenticated. An attacker can degrade service availability by causing the application to consume excessive CPU and memory resources. Patches are available in Wagtail 7.0.8, 7.3.3, and 7.4.2; organizations unable to upgrade immediately can implement the provided workaround by validating filter operations against an allowlist.

## Affected products

- Wagtail Wagtail < 7.0.8, >= 7.1 < 7.3.3, >= 7.4 < 7.4.2

## Identifiers

- CVE-2026-54260
- GHSA-f2p5-j6fg-5cxf
- PYSEC-2026-613

## Timeline

- 2026-06-15: disclosed: Published to GitHub Advisory Database
- 2026-06-15: patched: Patches released for Wagtail 7.0.8, 7.3.3, and 7.4.2
- 2026-08-20: advisory: Advisory published; CVE-2026-54260 assigned

## References

- [https://api.github.com/users/zerolab](https://api.github.com/users/zerolab)
- [https://github.com/zerolab](https://github.com/zerolab)
- [https://api.github.com/users/zerolab/gists%7B/gist_id%7D](https://api.github.com/users/zerolab/gists%7B/gist_id%7D)
- [https://api.github.com/users/zerolab/repos](https://api.github.com/users/zerolab/repos)
- [https://avatars.githubusercontent.com/u/31622?v=4](https://avatars.githubusercontent.com/u/31622?v=4)
- [https://api.github.com/users/zerolab/events%7B/privacy%7D](https://api.github.com/users/zerolab/events%7B/privacy%7D)

## Related threats

- [Wagtail permission bypass in copy page for translation](https://junglewise.ai/threats/cve-2026-125106-wagtail-is-an-open-source-content-management-system-built-on)
- [Wagtail Documents and Images API access control bypass](https://junglewise.ai/threats/cve-2026-123820-wagtail-is-an-open-source-content-management-system-built-on)
- [Wagtail snippet copy permission bypass](https://junglewise.ai/threats/cve-2026-123819-wagtail-is-an-open-source-content-management-system-built-on)
- [Wagtail Pages admin API improper access control](https://junglewise.ai/threats/cve-2026-55468-wagtail-pages-admin-api-improper-access-control)
- [Wagtail improper permission restriction on page translation API](https://junglewise.ai/threats/wagtail-improper-permission-restriction-on-page-translation-api-871f4804)