By vendor

Torchbox vulnerabilities

Known CVEs affecting Torchbox products, prioritized by severity, with SEC.co remediation and detection guidance.

5 published vulnerabilities

• CVE-2026-54263HIGH 7.3

  Wagtail, a Django-based open-source content management system, contains a reflected cross-site scripting (XSS) flaw in its admin interface's dynamic image URL generator. A lower-privileged admin editor can craft a malicious URL that, when clicked by a higher-privileged admin user, executes actions under that user's account. This affects all Wagtail installations, though only admin users are at risk—ordinary site visitors cannot exploit it. The issue has been patched in versions 7.0.8, 7.3.3, and 7.4.2.

• CVE-2026-54261MEDIUM 6.5

  Wagtail, a Django-based open-source content management system, contains a missing permission check on its image preview endpoint. An admin user with access to Wagtail's administrative interface can preview any image stored in the system without proper authorization controls. However, the vulnerability does not expose the underlying image metadata or object data itself, and it cannot be exploited by regular website visitors—only by someone who already has admin credentials. The issue affects versions before 7.0.8, 7.3.3, and 7.4.2 and has been patched in those releases.

• CVE-2026-54259MEDIUM 4.3

  Wagtail, a Django-based content management system, contains an information disclosure vulnerability in its Documents and Images chooser feature. When an administrator or staff member accesses these chooser interfaces, the system incorrectly reveals filenames, names, and URLs of documents and images that the user should not have permission to browse. This happens despite the user lacking explicit 'choose' permissions for those collections. The vulnerability requires an attacker to already have Wagtail admin access—ordinary website visitors cannot exploit it. Torchbox has patched this issue across three supported version branches.

• CVE-2026-54260MEDIUM 4.3

  Wagtail, a Django-based content management system, contains a vulnerability in versions before 7.0.8, 7.3.3, and 7.4.2 that allows authenticated admin users to degrade system performance by uploading or processing images with specially crafted filter specifications. The vulnerability requires admin-level access to the Wagtail backend, so it cannot be exploited by regular website visitors. When triggered, the malicious filter specs force the system to perform expensive image rendition processing operations that consume significant server resources, potentially slowing or disrupting the CMS for all users.

• CVE-2026-54262MEDIUM 4.3

  Wagtail, a Django-based content management system, has a permission bypass vulnerability affecting versions before 7.0.8, 7.3.3, and 7.4.2. Users with the basic "Can submit translation" permission can circumvent access controls to create translations for any page in the system, regardless of whether they have permission to modify that content. This allows unauthorized users to introduce translations into restricted content areas. The vulnerability has been patched in the three specified releases.