Detections
Analytics
SCA: security update for wagtail (GHSA-23m2-mghx-vqmf)
high Tenable Self-Hosted Container Security Plugin ID 446144
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and
7.4.2, reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view
within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin
could craft a URL that, when viewed by a user with higher privileges, could perform actions with that
user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic
image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the
Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2. (CVE-2026-54263)
Solution
Update the wagtail library and its related packages to version 7.3.3 or later.See Also
Plugin Details
Severity: High
ID: 446144
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 8/20/2026
Updated: 8/20/2026
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.64
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 8.5
Temporal Score: 6.3
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N
CVSS Score Source: CVE-2026-54263
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 6.4
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 8/20/2026
Vulnerability Publication Date: 7/1/2026
Reference Information
CVE: CVE-2026-54263
cwe: CWE-79