CVE-2025-45388

Wagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting (XSS) in the document upload functionality. Attackers can inject malicious code inside a PDF file. When a user clicks the document in the CMS interface, the payload executes. NOTE: this is disputed by the Supplier because "It has been well documented that when serving uploaded files using a method outside of Wagtail (which admittedly is the default), it requires additional configuration from the developer, because Wagtail cannot control how these are served. ... For example, if a Wagtail instance is configured to upload files into AWS S3, Wagtail cannot control the permissions on how they're served, nor any headers used when serving them (a limitation of S3)."

• CWE-79

• https://docs.wagtail.org/en/stable/deployment/under_the_hood.html#documents
• https://github.com/echoBRT/Wagtail-CMS-XSS/
• https://github.com/wagtail/wagtail/discussions/12617
• https://github.com/wagtail/wagtail/pull/12672
• https://github.com/wagtail/wagtail/wiki/Security-team
• https://github.com/echoBRT/Wagtail-CMS-XSS/

Published

May 7, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-45375Dell PowerProtect Data Domain with Data Domain Operating Sys…4.4
• CVE-2025-45376Dell Repository Manager (DRM), versions 3.4.7 and 3.4.8, con…7.8
• CVE-2025-45378Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerab…9.1
• CVE-2025-45379Dell CloudLink, versions prior to 8.2, contain a vulnerabili…8.4
• CVE-2025-4538A vulnerability was found in kkFileView 4.4.0. It has been c…9.8
• CVE-2025-45387osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Brok…5.4
• CVE-2025-4539A vulnerability was found in Hainan ToDesk 4.7.6.3. It has b…7.3
• CVE-2025-4540A vulnerability was found in MTSoftware C-Lodop 6.6.1.1 on W…7.3
• CVE-2025-45406A stored cross-site scripting (XSS) vulnerability in CodeIgn…6.1
• CVE-2025-4541A vulnerability classified as critical has been found in Lmx…8.8
• CVE-2025-4542A vulnerability, which was classified as problematic, has be…4.2
• CVE-2025-45422Incorrect access control in Proximus b-box v8c.725A allows a…8.1