CVE-2026-125105
3.7 LOWpublic exploit availablePublished 2026-11-09 · Updated 2026-11-10
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, Wagtail applies ETag conditional request processing to the document serve endpoint before document permission and filename checks complete. An unauthenticated attacker who knows a document ID and a candidate SHA1 hash can submit If-Match or If-None-Match and distinguish the response, revealing whether that hash is present in the document library. The issue does not expose document contents, filenames, other metadata, or information about hashes the attacker does not already know. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-280
Public exploit & PoC references
- https://github.com/wagtail/wagtail/commit/2db8a92ab888467bdd008b8e098c3d94d7da25f3
- https://github.com/wagtail/wagtail/commit/a1402376889be87cfc413cf9f2694a547d2b77c7
- https://github.com/wagtail/wagtail/commit/c4c38746855a562f451838fbfe0c77dab2c61829
- https://github.com/wagtail/wagtail/commit/f05649908fb727035108194792fb5e4f9bb6c1b8
- https://github.com/wagtail/wagtail/releases/tag/v7.0.9
- https://github.com/wagtail/wagtail/releases/tag/v7.3.4
- https://github.com/wagtail/wagtail/releases/tag/v7.4.3
- https://github.com/wagtail/wagtail/releases/tag/v8.0rc2
- https://github.com/wagtail/wagtail/security/advisories/GHSA-92hv-j533-69wc
All references
- https://github.com/wagtail/wagtail/commit/2db8a92ab888467bdd008b8e098c3d94d7da25f3
- https://github.com/wagtail/wagtail/commit/a1402376889be87cfc413cf9f2694a547d2b77c7
- https://github.com/wagtail/wagtail/commit/c4c38746855a562f451838fbfe0c77dab2c61829
- https://github.com/wagtail/wagtail/commit/f05649908fb727035108194792fb5e4f9bb6c1b8
- https://github.com/wagtail/wagtail/releases/tag/v7.0.9
- https://github.com/wagtail/wagtail/releases/tag/v7.3.4
- https://github.com/wagtail/wagtail/releases/tag/v7.4.3
- https://github.com/wagtail/wagtail/releases/tag/v8.0rc2
- https://github.com/wagtail/wagtail/security/advisories/GHSA-92hv-j533-69wc
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-123819PoC
- MEDIUMCVE-2026-123820PoC
- MEDIUMCVE-2026-125106PoC
- MEDIUMCVE-2026-20577
- MEDIUMCVE-2026-20599
- UNSCOREDCVE-2026-21121
- UNSCOREDCVE-2026-3322PoC
- LOWCVE-2026-54471
Related by shared AI tags and CWE weakness class. Browse the full archive.