CVE-2026-54263: Wagtail reflected XSS in dynamic image URL generator

CVE-2026-54263 · Severity: high · CVSS 7.3 · Published 2026-07-01

Wagtail is a popular Django-based content management system used by organizations to manage web content. This vulnerability allows a lower-privileged admin user to craft a malicious URL that, when clicked by a higher-privileged administrator, can execute arbitrary actions in the CMS admin interface under the victim's account. While limited to users with admin access, this could lead to unauthorized content modifications, data theft, or further system compromise.

Technologies: wagtail (PyPI), Wagtail. Vendors: PyPI, Wagtail.

Quick answers

Is CVE-2026-54263 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54263 being exploited in the wild.
How severe is CVE-2026-54263?
High severity, with a CVSS score of 7.3, published 1 July 2026.
Which products and versions are affected?
wagtail (PyPI) ECOSYSTEM:introduced=7.3,fixed=7.3.3, ECOSYSTEM:introduced=7.3,fixed=7.3.3,introduced=7.4,fixed=7.4.2; Wagtail < 7.0.8, >= 7.1.0 < 7.3.3, >= 7.4.0 < 7.4.2.
Is there a fix for CVE-2026-54263?
Yes. wagtail (PyPI): upgrade to 7.3.3, 7.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54263 attacked?
It is attacked over the network.
Am I affected by CVE-2026-54263?
Check whether you run wagtail (PyPI) or Wagtail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • wagtail (PyPI): upgrade to 7.3.3, 7.4.2 or later
    pip install "wagtail>=7.4.2"

Technical details

This is a reflected XSS vulnerability (CWE-79) in the dynamic image URL generator view endpoint at `/admin/images/<int:image_id>/generate_url/output/` within Wagtail's admin interface. The vulnerable component fails to properly sanitize user-controllable input before including it in the HTML response served to other users. The attack requires the attacker to have at least limited editor-level permissions to the Wagtail admin (PR:L), and requires user interaction (UI:R) in the form of a higher-privileged user clicking the malicious link. Once exploited, an attacker gains the ability to perform any action in the admin interface that the victim user can perform, including reading/modifying sensitive content. Patches are available in Wagtail 7.3.3 and 7.4.2; a workaround is available by overriding the vulnerable URL pattern.

Affected products

  • Torchbox Wagtail >= 7.3, < 7.3.3; >= 7.4, < 7.4.2

Identifiers

  • CVE-2026-54263
  • GHSA-23m2-mghx-vqmf
  • PYSEC-2026-616

Timeline

  • 2026-06-15: disclosed: Vulnerability published to GitHub Advisory Database
  • 2026-06-15: patched: Patches released as Wagtail 7.3.3 and 7.4.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.