EUVD-2026-87082
GHSA-2w4j-r762-9783
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Wagtail Editor credentials
-
DeliverySave blog entry with crafted payload via EntryAbstract.save()
-
ExploitVictim admin/reviewer opens entry
-
ExecutionScript executes in victim browser session
-
ImpactSession hijack or actions as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account with Wagtail Editor privileges in a deployment running APSL Puput v1.2.1 through v2.2.0. The attacker saves a crafted payload through the EntryAbstract.save() code path (blog entry editing), and a victim must then view the affected content (UI:R) for the script to execute in their browser. Limiting factors: exploitation is gated behind existing CMS editor authentication (not truly unauthenticated despite the published PR:N), depends on a victim viewing the entry, and only affects environments where Puput is deployed as the blog component of a Wagtail site. |
| Impact | This is a classic low-to-moderate-risk stored/reflected XSS. The NVD CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is driven mostly by the scope change and network vector, not by real severity. There is a direct CONFLICT between the CVSS vector and the description: the vector encodes PR:N (no privileges), but the description explicitly states exploitation requires 'authenticated attackers with Wagtail Editor privileges.' The description is more specific and credible, so effective privilege is PR:L - the PR:N in the published vector appears wrong and inflates the score. EPSS is very low (0.15%, 4th percentile), there is no CISA KEV listing, and no evidence of active exploitation. A public gist (itsmohitnarayan) is referenced and likely constitutes proof-of-concept material. Net: a real but low-priority issue - an authenticated, already-trusted Wagtail Editor injecting script that fires in another user's browser (e.g. an admin/reviewer viewing the entry). This is a privilege-boundary/self-XSS-adjacent concern, not a mass-exploitable remote flaw. The 'RCE' tag is inaccurate: the description describes script execution in the victim's browser, which is XSS, not server-side remote code execution. |
| Exploit ScenarioDerived | An attacker who already holds Wagtail Editor privileges saves a blog entry (via EntryAbstract.save()) containing a crafted XSS payload; when another authenticated user such as an admin or reviewer views the entry in the CMS, the script executes in their browser session, potentially stealing session cookies or performing actions as that user. A public gist referenced in the CVE likely provides proof-of-concept payload details. Exploitation requires the victim to view the malicious content (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Reflected cross-site scripting in APSL Puput v1.2.1 through v2.2.0 lets an authenticated user holding Wagtail Editor privileges inject a crafted payload through the EntryAbstract.save() blog-entry editing path, which then executes in a victim's browser when the affected content is viewed. The impact is script execution in the victim's session context (CVSS 3.1 base 6.1, scope-changed, confidentiality and integrity low, availability none), enabling session or credential theft, CMS action forgery, and content defacement rather than direct server-side code execution. Risk is bounded: exploitation requires an existing editor account and victim interaction, and there is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is 0.15 percent (4th percentile), reflecting a low predicted likelihood of exploitation.
RemediationAI
No vendor-released patch is identified at time of analysis, and no fixed version appears in the provided advisory, CPE, or reference data, so teams must treat the v1.2.1 through v2.2.0 range as unfixed and track the project's repository for an upstream release, PR, or commit; check https://nvd.nist.gov/vuln/detail/CVE-2026-88420 and the referenced Gist for updates before assuming a fix exists. The most effective compensating control is privilege reduction: audit and minimize the set of accounts holding Wagtail Editor privileges, since the flaw is reachable only through that authenticated code path, and require re-approval before granting editor access. Where editing cannot be curtailed, deploy a strict Content-Security-Policy on the Wagtail admin and public blog templates (for example, disallowing inline script and restricting script-src to trusted origins), accepting that CSP breaks inline scripts and some third-party widgets and must be tested first. Additional mitigations include sanitizing or stripping HTML from entry fields at the application layer, enabling Django/Wagtail output escaping and any available XSS filtering, and restricting admin access to trusted networks or behind an authenticated reverse proxy to shrink the viewer population required by the UI:R precondition. Because exploitation also requires a victim to view the crafted entry, monitoring for anomalous editor activity and reverting suspicious entries reduces dwell time; none of these controls remove the underlying flaw.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Puput is an open-source blog application built on the Django web framework and the Wagtail CMS; its EntryAbstract model wraps blog entries and provides a save() code path invoked when editors create or modify entries through the Wagtail admin. The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically an XSS issue reachable through that save() component, where attacker-supplied content is not adequately escaped or sanitized before being rendered back to a viewer. The provided CPE string is unmapped (cpe:2.3:a:n/a:n/a), so automated asset matching is unreliable and version detection must be done directly against the installed Puput package; EUVD also lists the affected version as 'n/a n/a', leaving the CVE description's stated v1.2.1 through v2.2.0 range as the authoritative affected window. Although the source tags include 'RCE', the assessed impact is browser-side script execution with scope change (S:C) and low confidentiality/integrity impact, not server-side remote code execution. The CVSS vector accompanying the CVE claims PR:N, but the authoritative independent assessment is PR:L, placing exploitation behind a pre-existing Wagtail Editor account; the UI:R component confirms a victim must still view the crafted entry for the payload to run.
Know when Wagtail gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Description requires an authenticated Wagtail Editor (PR:L, correcting the published PR:N), victim must view the payload (UI:R), and injected script crosses into the victim's browser context (S:C, C:L/I:L).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute arbitrary code in the context of the victim's browser via a crafted payload.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision compa
Wagtail is an open source content management system built on Django. Rated medium severity (CVSS 5.4), this vulnerabilit
Reflected cross-site scripting in the Wagtail Django CMS admin interface lets a low-privilege editor craft a malicious U
Wagtail is an open source content management system built on Django. Rated medium severity (CVSS 6.5), this vulnerabilit
Missing authorization on the image preview endpoint in Wagtail CMS allows any authenticated admin-panel user to render p
Stored XSS in Wagtail's TableBlock allows authenticated users with page editing permissions to inject malicious class at
Stored XSS in Wagtail's simple_translation module allows authenticated admin users to inject malicious JavaScript throug
Wagtail is an open source content management system built on Django. Rated medium severity (CVSS 5.4), this vulnerabilit
In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagt
Wagtail is an open source content management system built on Django. Rated medium severity (CVSS 4.9), this vulnerabilit
Wagtail is a Django content management system. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploita
In Wagtail before versions 2.7.3 and 2.8.2, a potential timing attack exists on pages or documents that have been protec
Exploit-DB