CVE-2025-54433: Bugsink path traversal via event_id in ingestion
(updated )
In affected versions, ingestion paths construct file locations directly from untrusted event_id input without validation. A specially crafted event_id can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations.
Submitting such input requires access to a valid DSN. While that limits exposure, DSNs are sometimes discoverable—for example, when included in frontend code—and should not be treated as a strong security boundary.
References
- github.com/advisories/GHSA-q78p-g86f-jg6q
- github.com/bugsink/bugsink
- github.com/bugsink/bugsink/commit/1001726f4389e982c486cdd5fa81941cb46cfc33
- github.com/bugsink/bugsink/commit/211ddf76758c808c095b5f836c363f148d934d21
- github.com/bugsink/bugsink/commit/2c41fbe3881bdea83399a7f9fdc8cff198ae089f
- github.com/bugsink/bugsink/commit/53cf1a17a3e96f7c83c7451fd56f980a09d0c9b0
- github.com/bugsink/bugsink/commit/55a155003d0b416ea008c5e7dcde85130ad21d9b
- github.com/bugsink/bugsink/commit/b94aa8a5c96ce8cdd9711b6beb4e518264993ac2
- github.com/bugsink/bugsink/commit/c341687bd655543730c812db35c29199f788be6b
- github.com/bugsink/bugsink/commit/c87217bd565122ba70af90436e3ab2cd9bee658f
- github.com/bugsink/bugsink/security/advisories/GHSA-q78p-g86f-jg6q
- nvd.nist.gov/vuln/detail/CVE-2025-54433
Code Behaviors & Features
Detect and mitigate CVE-2025-54433 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →