Executive brief
Wagtail, a popular open-source content management system, contains a vulnerability in its document serving endpoint that allows attackers to determine whether a specific document exists in the library by its SHA1 hash using HTTP header manipulation. The vulnerability bypasses permission restrictions and enables hash-based document enumeration, but does not expose document contents or metadata beyond the known hash value.
Technical details
The vulnerability exists in Wagtail's document serving endpoint, which improperly handles conditional HTTP headers (If-Match and If-None-Match) when processing requests to the `/documents/` endpoint. An attacker can leverage these headers to perform hash-matching checks against documents in the library without authentication or authorization, defeating permission controls. The root cause is improper validation of insufficient permissions when accessing document metadata. The attack requires only network access to the document serve URL; no user interaction or special privileges are needed. An attacker with a known SHA1 hash can determine whether that exact document exists in the Wagtail installation. Patches are available in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 and later. Workarounds include stripping conditional headers at the reverse proxy level or removing the file_hash attribute from custom document models.
Affected products
- Wagtail Wagtail < 7.0.9, >= 7.1 < 7.3.4, >= 7.4 < 7.4.3, = 8.0rc1
Timeline
- 2026-08-20: disclosed: Vulnerability advisory published
- 2026-08-20: patched: Patches released in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2