216.73.217.98

CVE-2025-54433

· Published 30/07/2025 15:15 · Modified 31/07/2025 18:42

Labels: CVE-2025-54433 2025-07-30CVE-2025-54433CWE-22[email protected]

Essential information

Published
30/07/2025 15:15
Modified
31/07/2025 18:42
Author
—
Creator
—
CVSS
7.2 HIGH (v3) 7.2 HIGH (v4.0)
CISA KEV
No
CWE
—
CVSS vector
—

CVSS metrics

Description

Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 through 1.6.3, and 1.7.0 through 1.7.3, ingestion paths construct file locations directly from untrusted event_id input without validation. A specially crafted event_id can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such input requires access to a valid DSN, potentially exposing them. If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user. This is fixed in versions 1.4.3, 1.5.5, 1.6.4 and 1.7.4.

NVD status

Status
Awaiting Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
bugsink / bugsink cpe:2.3:a:bugsink:bugsink:1.4.2:*:*:*:*:*:*:*
bugsink / bugsink cpe:2.3:a:bugsink:bugsink:1.5.0-1.5.4:*:*:*:*:*:*:*
bugsink / bugsink cpe:2.3:a:bugsink:bugsink:1.6.0-1.6.3:*:*:*:*:*:*:*
bugsink / bugsink cpe:2.3:a:bugsink:bugsink:1.7.0-1.7.3:*:*:*:*:*:*:*

References