See https://docs.wagtail.org/en/latest/contributing/security.html.
This information can also be found in our security.txt: https://wagtail.org/.well-known/security.txt
Security: wagtail/wagtail
Security
.github/SECURITY.md
-
Disclosure of user names via admin bulk action viewsGHSA-fc75-58r8-rm3h published
Oct 19, 2023 by gasmanLow -
Denial-of-service via memory exhaustion when uploading large filesGHSA-33pv-vcgh-jfg9 published
Apr 3, 2023 by gasmanModerate -
Stored XSS attack via ModelAdmin viewsGHSA-5286-f2rf-35c2 published
Apr 3, 2023 by gasmanModerate -
Comment reply notifications sent to incorrect usersGHSA-xqxm-2rpm-3889 published
Jan 18, 2022 by gasmanLow -
Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocksGHSA-xfrw-hxr5-ghqf published
Jun 17, 2021 by gasmanModerate -
Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fieldsGHSA-wq5h-f9p5-q7fx published
Apr 19, 2021 by gasmanModerate -
HTML injection through form field help textGHSA-2473-9hgq-j7xw published
Jul 20, 2020 by gasmanModerate -
Potential timing attack on password-protected private pagesGHSA-jjjr-3jcw-f8v6 published
May 4, 2020 by gasmanLow -
Possible XSS attack via page revision comparison viewGHSA-v2wc-pfq2-5cm6 published
Apr 14, 2020 by gasmanModerate
Learn more about advisories related to wagtail/wagtail in the GitHub Advisory Database