CVE-2025-54433 json
Bugsink is vulnerable to Path Traversal attacks via event_id in ingestion
published 2025-07-29 15 mo ago modified 2026-07-07 4 mo ago also EUVD-2025-23153 , GHSA-q78p-g86f-jg6q , PYSEC-2026-1226
- cvss
- 7.2
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 through 1.6.3, and 1.7.0 through 1.7.3, ingestion paths construct file locations directly from untrusted event_id input without validation. A specially crafted event_id can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such input requires access to a valid DSN, potentially exposing them. If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user. This is fixed in versions 1.4.3, 1.5.5, 1.6.4 and 1.7.4.
Patch / fix
- pypi bugsink 1.4.3, 1.5.5, 1.6.4, 1.7.4
- bugsink bugsink 1.4.3, 1.5.5, 1.6.4, 1.7.4
- github.com/bugsink/bugsink@1001726 commit
- github.com/bugsink/bugsink@211ddf7 commit
- github.com/bugsink/bugsink@2c41fbe commit
- github.com/bugsink/bugsink@53cf1a1 commit
- github.com/bugsink/bugsink@55a1550 commit
- github.com/bugsink/bugsink@b94aa8a commit
- github.com/bugsink/bugsink@c341687 commit
- github.com/bugsink/bugsink@c87217b commit
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 15 mo ago
Exploit prediction
0.66% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | bugsink | >=1.7.0, <1.7.4 >=1.6.0, <1.6.4 >=1.5.0, <1.5.5 <1.4.3 |
1.7.4 1.6.4 1.5.5 1.4.3 |
Affected products
- bugsink bugsink
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/bugsink/bugsink/commit/1001726f4389e982c486cdd5fa81941cb46cfc33
web
-
github.com
/bugsink/bugsink/commit/211ddf76758c808c095b5f836c363f148d934d21
web
-
github.com
/bugsink/bugsink/commit/2c41fbe3881bdea83399a7f9fdc8cff198ae089f
web
-
github.com
/bugsink/bugsink/commit/53cf1a17a3e96f7c83c7451fd56f980a09d0c9b0
web
-
github.com
/bugsink/bugsink/commit/55a155003d0b416ea008c5e7dcde85130ad21d9b
web
-
github.com
/bugsink/bugsink/commit/b94aa8a5c96ce8cdd9711b6beb4e518264993ac2
web
-
github.com
/bugsink/bugsink/commit/c341687bd655543730c812db35c29199f788be6b
web
-
github.com
/bugsink/bugsink/commit/c87217bd565122ba70af90436e3ab2cd9bee658f
web
-
github.com
/bugsink/bugsink/security/advisories/GHSA-q78p-g86f-jg6q
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-54433
advisory
-
github.com
/bugsink/bugsink
package
-
pypi.org
/project/bugsink
package
-
github.com
/advisories/GHSA-q78p-g86f-jg6q
advisory
Sources
- CVE List CVE-2025-54433
- GitHub Advisory GHSA-q78p-g86f-jg6q
- NVD CVE-2025-54433
- OSV PYSEC-2026-1226
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.