GHSA-92HV-J533-69WC: Information Disclosure via ETag Conditional Matching in Wagtail CMS
Vulnerability ID: GHSA-92HV-J533-69WC
CVSS Score: 3.7
Published: 2026-08-20
An information disclosure vulnerability in the document serving subsystem of Wagtail CMS allows unauthorized users to verify if private documents match guessed SHA-1 hashes due to improper order of authentication checks.
TL;DR
Wagtail CMS evaluates HTTP ETag headers before enforcing authentication and authorization checks on document serve views, leaking whether specific documents match guessed SHA-1 hashes.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-280
- Attack Vector: Network
- CVSS v3.1: 3.7 (Low)
- Vulnerability Type: Information Disclosure
- Exploit Status: Proof of Concept
- Component: wagtail/documents/views/serve.py
Affected Systems
- Wagtail CMS
-
Wagtail: < 7.0.9 (Fixed in:
7.0.9) -
Wagtail: >= 7.1, < 7.3.4 (Fixed in:
7.3.4) -
Wagtail: >= 7.4, < 7.4.3 (Fixed in:
7.4.3) -
Wagtail: == 8.0rc1 (Fixed in:
8.0rc2)
Code Analysis
Commit: 4f57d58
Deconstruct global etag decorator into dynamically executed inner serve logic.
Mitigation Strategies
- Upgrade Wagtail to a patched version (7.0.9, 7.3.4, 7.4.3, or 8.0rc2 depending on active branch).
- Strip 'If-Match' and 'If-None-Match' headers from incoming requests to the /documents/ path at the reverse proxy or WAF layer.
Remediation Steps:
- Identify current Wagtail version deployed in the target environment.
- Update the dependencies file (e.g. requirements.txt) to specify the secure version of Wagtail.
- Run pip install -r requirements.txt to apply the upgrade in target environments.
- Deploy the updated application and verify that conditional GET requests to private documents by unauthorized clients no longer return HTTP 304 status codes.
References
- GitHub Security Advisory GHSA-92HV-J533-69WC
- Wagtail Project Security Advisory
- Wagtail CMS Main Source Code Repository
Read the full report for GHSA-92HV-J533-69WC on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)