Low severity · published Jul 1, 2026
CVE-2026-54260
Wagtail: Denial of service via unbounded filter specs in the image preview
2.7
CVSS
0.4%
EPSS
No
On KEV
Description
Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, an authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
wagtail · wagtail
< 7.0.8; >= 7.1.0, < 7.3.3; >= 7.4.0, < 7.4.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54260
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54260
Mitigation
https://github.com/wagtail/wagtail/security/advisories/GHSA-f2p5-j6fg-5cxf
More from wagtail
7.3
CVE-2026-54263
Wagtail: Reflected XSS in dynamic image URL generator view
6.5
CVE-2026-54261
Wagtail: Improper permission handling in image preview
6.5
CVE-2026-44200
Wagtail: Improper permission handling when copying pages
6.5
CVE-2026-44199
Wagtail: Improper permission handling when deleting form submissions
6.5
CVE-2026-44197
Wagtail: Improper permission handling when comparing revisions