CVE-2026-54260: Wagtail: Denial of service via unbounded filter specs in the image preview

August 20, 2026

An authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

References

github.com/advisories/GHSA-f2p5-j6fg-5cxf
github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2026-613.yaml
github.com/wagtail/wagtail/security/advisories/GHSA-f2p5-j6fg-5cxf
nvd.nist.gov/vuln/detail/CVE-2026-54260

Code Behaviors & Features

Detect and mitigate CVE-2026-54260 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →