high · 7.3CVE-2026-54263Aug 20, 2026

CVE-2026-54263: Wagtail Reflected XSS in Dynamic Image URL Generator

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A low-privilege Wagtail editor can craft a link to the admin image URL generator that injects JavaScript into the browser of any higher-privileged admin who opens it.

Packagewagtail
Ecosystempip
Affected>= 7.3, < 7.3.3
Fixed in7.3.3
CVE-2026-54263: Wagtail Reflected XSS in Dynamic Image URL Generator

The problem

The admin endpoint at /admin/images/<id>/generate_url/output/ accepts a filter_spec parameter and reflects it back into the HTML response without output encoding.

Any authenticated editor, even one with minimal permissions, can craft a URL carrying a script payload in the filter_spec position. When a superuser or higher-privileged editor opens that link, the script runs in their browser under the Wagtail admin origin, allowing session hijacking or privilege escalation.

Proof of concept

A working proof-of-concept for CVE-2026-54263 in wagtail, with the exact payload below.

http
GET /admin/images/1/generate_url/output/?filter_spec=width-800%22%3E%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E HTTP/1.1
Host: example.com
Cookie: sessionid=<editor_session>

The generate_url/output view constructs an HTML response that includes the caller-supplied filter_spec value directly, without applying Django's template auto-escaping or explicit escape(). The closing-quote-plus-tag sequence ("><script>...) breaks out of whatever HTML attribute or text context the value is placed into and executes arbitrary JavaScript.

The patch adds proper output encoding to that view, so the reflected value is HTML-escaped before being written to the response. Public PoC not yet available; payload derived from the advisory workaround, endpoint structure, and CWE-79 root cause confirmed in the advisory.

The fix

Upgrade to Wagtail 7.3.3 (or 7.0.8 / 7.4.2 for other supported branches). If an immediate upgrade is not possible, override the vulnerable URL pattern in urls.py to return a plain HttpResponseBadRequest for the admin/images/<int:image_id>/generate_url/output/ path, as shown in the advisory workaround.

Restrict editor-level admin access to trusted users in the meantime.

Reported by Thibaud Colas (@thibaudcolas).

References: [1][2][3][4]

Related research