Log in Start free

Vulnerability · Published Jul 30, 2025 · Assigned by GitHub_M

CVE-2025-54433Bugsink is vulnerable to Path Traversal attacks via event_id in ingestion

High 7.2

In plain English

A high-severity path traversal in bugsink from bugsink. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.2High
Exploit odds (30 days)0.7%top 48.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 through 1.6.3, and 1.7.0 through 1.7.3, ingestion paths construct file locations directly from untrusted event_id input without validation. A specially crafted event_id can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such input requires access to a valid DSN, potentially exposing them. If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user. This is fixed in versions 1.4.3, 1.5.5, 1.6.4 and 1.7.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIbugsink1.7.4GHSA-q78p-g86f-jg6q
PyPIbugsink1.6.4GHSA-q78p-g86f-jg6q
PyPIbugsink1.5.5GHSA-q78p-g86f-jg6q
PyPIbugsink1.4.3GHSA-q78p-g86f-jg6q
PyPIbugsink1.4.3, 1.5.5, 1.6.4, 1.7.4PYSEC-2026-1226

Affected products (as reported)

VendorProductVersions
bugsink bugsink >= 1.7.0, < 1.7.4>= 1.6.0, < 1.6.4>= 1.5.0, < 1.5.5< 1.4.3

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

References