Executive brief
Wagtail is a popular Django-based content management system used by organizations to manage web content. This vulnerability allows a lower-privileged admin user to craft a malicious URL that, when clicked by a higher-privileged administrator, can execute arbitrary actions in the CMS admin interface under the victim's account. While limited to users with admin access, this could lead to unauthorized content modifications, data theft, or further system compromise.
Technical details
This is a reflected XSS vulnerability (CWE-79) in the dynamic image URL generator view endpoint at `/admin/images/<int:image_id>/generate_url/output/` within Wagtail's admin interface. The vulnerable component fails to properly sanitize user-controllable input before including it in the HTML response served to other users. The attack requires the attacker to have at least limited editor-level permissions to the Wagtail admin (PR:L), and requires user interaction (UI:R) in the form of a higher-privileged user clicking the malicious link. Once exploited, an attacker gains the ability to perform any action in the admin interface that the victim user can perform, including reading/modifying sensitive content. Patches are available in Wagtail 7.3.3 and 7.4.2; a workaround is available by overriding the vulnerable URL pattern.
Affected products
- Torchbox Wagtail >= 7.3, < 7.3.3; >= 7.4, < 7.4.2
Timeline
- 2026-06-15: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-06-15: patched: Patches released as Wagtail 7.3.3 and 7.4.2