Reflected Cross-Site Scripting in Wagtail Dynamic Image URL Generator

Wagtail versions 7.3.0 through 7.3.2 and 7.4.0 through 7.4.1 are affected by a reflected cross-site scripting (XSS) vulnerability in the dynamic image URL generator view. The vulnerability resides within the Wagtail admin interface and allows a user with limited permissions, such as an editor, to craft a malicious URL. When a high-privilege user, such as an administrator, accesses this URL while logged into the admin interface, the malicious script is executed in their session context. This can lead to unauthorized administrative actions being performed on behalf of the victim. The flaw affects all Wagtail installations, regardless of whether the specific dynamic image serve view is enabled. Wagtail has released versions 7.3.3 and 7.4.2 to address this issue.

Impact

The vulnerability poses a significant risk to the integrity of the Wagtail CMS by enabling privilege escalation through session hijacking or unauthorized administrative action. If exploited, an attacker could manipulate content, change site settings, or create new administrative accounts. The attack requires the attacker to have at least a low-privileged editor account, limiting the scope to internal threats or compromised low-level accounts.

Recommendation

Prioritized actions for security teams:

• Upgrade Wagtail instances to version 7.3.3 or 7.4.2 immediately to remediate CVE-2026-54263.
• If upgrading is not immediately possible, implement the URL pattern workaround in 'urls.py' provided by the vendor to disable the vulnerable 'generate_url/output/' endpoint.
• Audit Wagtail admin access logs for abnormal requests to '/admin/images/*/generate_url/output/' originating from non-administrator user accounts.