Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

wagtail/wagtail

              main @ 1116768
            

136

Fixes

CVEs

HIGH

Peak severity

26.5%

Coverage

Highlights

Auth Bypass: 68 prior fixes. Scrutinize any change in this area.

wagtail/admin/views/pages.py: most-fixed (5 issues). Treat as high-risk during review.

26 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The translation submission views failed to validate explicit user edit and object-level permissions, allowing unauthorized translation submissions across pages and snippets. This is tracked under CVE-2026-28223.

Auth Bypass: Page permission validation logic relied on prefix-based string prefix matching on paths rather than structural tree-based queries, allowing users to bypass page access restrictions.

Denial of Service: Processing uploaded images lacked validation for decompression bombs (Pillow crashes) and pixel limit bounds, creating out-of-memory risks. This is tracked under CVE-2023-28837.