https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 14:40:22 +0000 https://cve.radiocsirt.org/vuln/cve-2025-54433 <p><strong>Affected:</strong> bugsink</p> <p>Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 through 1.6.3, and 1.7.0 through 1.7.3, ingestion paths construct file locations directly from untrusted event_id input without validation. A specially crafted event_id can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such input requires access to a valid DSN, potentially exposing them. If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user. This is fixed in versions 1.4.3, 1.5.5, 1.6.4 and 1.7.4.</p> <p><strong>Affected:</strong> bugsink</p> <p>Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 through 1.6.3, and 1.7.0 through 1.7.3, ingestion paths construct file locations directly from untrusted event_id input without validation. A specially crafted event_id can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such input requires access to a valid DSN, potentially exposing them. If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user. This is fixed in versions 1.4.3, 1.5.5, 1.6.4 and 1.7.4.</p> https://cve.radiocsirt.org/vuln/cve-2025-54433 https://cve.radiocsirt.org/vuln/pysec-2026-1226 <p><strong>Affected:</strong> PyPI: bugsink</p> <p>## Summary</p> <p>In affected versions, ingestion paths construct file locations directly from untrusted `event_id` input without validation. A specially crafted `event_id` can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations.</p> <p>Submitting such input requires access to a valid DSN. While that limits exposure, DSNs are sometimes discoverable—for example, when included in frontend code—and should not be treated as a strong security boundary.</p> <p>## Impact</p> <p>A valid DSN holder can craft an `event_id` that causes the ingestion process to write files outside its designated directory. This allows overwriting files accessible to the user running Bugsink.</p> <p>If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user.</p> <p>## Mitigation</p> <p>Update to version `1.7.4`, `1.6.4`, `1.5.5` or `1.4.3` , which require `event_id` to be a valid UUID and normalizes it before use in file paths.</p> <p><strong>Affected:</strong> PyPI: bugsink</p> <p>## Summary</p> <p>In affected versions, ingestion paths construct file locations directly from untrusted `event_id` input without validation. A specially crafted `event_id` can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations.</p> <p>Submitting such input requires access to a valid DSN. While that limits exposure, DSNs are sometimes discoverable—for example, when included in frontend code—and should not be treated as a strong security boundary.</p> <p>## Impact</p> <p>A valid DSN holder can craft an `event_id` that causes the ingestion process to write files outside its designated directory. This allows overwriting files accessible to the user running Bugsink.</p> <p>If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user.</p> <p>## Mitigation</p> <p>Update to version `1.7.4`, `1.6.4`, `1.5.5` or `1.4.3` , which require `event_id` to be a valid UUID and normalizes it before use in file paths.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1226