Wagtail CMS CVE-2026-54260

Exploitation requires an active authenticated session with Wagtail admin-level access - the CVE description explicitly states the vulnerability 'is not exploitable by an ordinary site visitor without access to the Wagtail admin.' The attacker must be able to submit image filter specifications to the rendition processing system, meaning the Wagtail image management feature must be in use on the target installation. The CVSS AV:N confirms no special network positioning is required beyond reaching the admin interface over the network. Limiting factors: valid admin credentials are mandatory, restricting exploitation to insiders, compromised accounts, or environments where admin access is broadly granted; unauthenticated exploitation is explicitly ruled out by the vendor.

The NVD-assigned CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L reflects a network-accessible, low-complexity, availability-only issue requiring authenticated access. The PR:L metric indicates a low-privilege authenticated user is sufficient per NVD's scoring, though the description explicitly names 'admin user' - a potential upward bias on the privilege requirement that may warrant PR:H independently. No EPSS score was provided in the available intelligence data, which is a gap in probabilistic risk quantification. There is no CISA KEV entry and no public proof-of-concept code identified, indicating no observed active exploitation. SSVC assessment: exploitation status is 'none publicly known'; the vulnerability is not automatable against unauthenticated targets; technical impact is partial, limited to availability. Real-world priority is genuinely low for most deployments - the primary concern is insider threat, credential compromise of admin accounts, or multi-tenant SaaS Wagtail platforms where untrusted parties hold admin credentials.

An authenticated Wagtail admin user - whether a malicious insider or an attacker who has compromised admin credentials - submits a series of purposefully crafted image filter specification strings via the Wagtail admin interface. The server processes each request by executing computationally expensive rendition operations, consuming disproportionate CPU or memory resources and progressively degrading response times for all site visitors. No public proof-of-concept has been identified, so exploitation likely requires knowledge of Wagtail's image rendition API internals.