CVE-2026-125105

Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, Wagtail applies ETag conditional request processing to the document serve endpoint before document permission and filename checks complete. An unauthenticated attacker who knows a document ID and a candidate SHA1 hash can submit If-Match or If-None-Match and distinguish the response, revealing whether that hash is present in the document library. The issue does not expose document contents, filenames, other metadata, or information about hashes the attacker does not already know. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.

• CWE-280

• https://github.com/wagtail/wagtail/commit/2db8a92ab888467bdd008b8e098c3d94d7da25f3
• https://github.com/wagtail/wagtail/commit/a1402376889be87cfc413cf9f2694a547d2b77c7
• https://github.com/wagtail/wagtail/commit/c4c38746855a562f451838fbfe0c77dab2c61829
• https://github.com/wagtail/wagtail/commit/f05649908fb727035108194792fb5e4f9bb6c1b8
• https://github.com/wagtail/wagtail/releases/tag/v7.0.9
• https://github.com/wagtail/wagtail/releases/tag/v7.3.4
• https://github.com/wagtail/wagtail/releases/tag/v7.4.3
• https://github.com/wagtail/wagtail/releases/tag/v8.0rc2
• https://github.com/wagtail/wagtail/security/advisories/GHSA-92hv-j533-69wc

Published

Nov 9, 2026

Last Modified

Nov 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12510The AI Engine WordPress plugin before 3.5.5 does not verify…5.9
• CVE-2026-125100FFmpeg through 9.0.2 contains an integer overflow vulnerabil…3.3
• CVE-2026-125101FFmpeg through 9.0.2 contains an information disclosure vuln…3.3
• CVE-2026-125102FFmpeg through 9.0.2 contains an uninitialized memory disclo…3.3
• CVE-2026-125103FFmpeg through 9.0.2 contains an information disclosure vuln…3.3
• CVE-2026-125104FFmpeg through 9.0.2 contains a memory exhaustion vulnerabil…5.5
• CVE-2026-125107Muhammara is a node module with c/cpp bindings to modify PDF…7.5
• CVE-2026-125109Rack is a modular Ruby web server interface. From 3.0 until …4.8
• CVE-2026-12511The AI Engine WordPress plugin before 3.5.5 does not saniti…8.1
• CVE-2026-125113The XRootD project provides a high-performance, fault-tolera…5.3
• CVE-2026-125115Novu provides an API for sending notifications through multi…6.8
• CVE-2026-125117Mongoose is a MongoDB object modeling tool designed to work …8.2