ETag Conditional Request Processing Vulnerability in Wagtail by Wagtail
CVE-2026-125105
What is CVE-2026-125105?
Wagtail, an open-source content management system built on Django, contains a vulnerability in its ETag conditional request processing. Prior to specific updates, the system fails to complete document permission and filename checks before applying ETag conditions. An unauthenticated attacker with knowledge of a document ID and a SHA1 hash can exploit this flaw by sending If-Match or If-None-Match requests. While this does not expose document contents or filenames, it allows an attacker to verify the presence of certain SHA1 hashes within the document library. This vulnerability is addressed in the latest versions of Wagtail, and users are urged to upgrade to mitigate potential risks.
Affected Version(s)
wagtail < 7.0.9 < 7.0.9
wagtail >= 7.1, < 7.3.4 < 7.1, 7.3.4
wagtail >= 7.4, < 7.4.3 < 7.4, 7.4.3