Executive brief
Sentry is an error tracking and performance monitoring platform used by developers to diagnose and fix application issues. Versions 23.11.0 through 26.6.x with the relocation feature enabled contain an unsafe deserialization vulnerability that allows an authenticated user to execute arbitrary code on the import worker process by supplying a malicious relocation archive. This could enable attackers to gain full control of the server processing imports.
Technical details
The vulnerability is a Python unsafe deserialization (pickle or similar) flaw in the relocation archive import functionality. An authenticated user can craft a malicious archive containing specially crafted data in legacy database fields that triggers arbitrary code execution when deserialized by the import worker. The vulnerability requires authentication and intentional upload of a crafted archive, but the relocation feature must be explicitly enabled (disabled by default in self-hosted installations).
Affected products
- Sentry Sentry 23.11.0 to 26.6.x
Timeline
- 2026-09-22: disclosed
- 2026-07-14: patched: Fixed in version 26.7.0