Bugsink is vulnerable to Path Traversal attacks via event_id in ingestion
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 through 1.6.3, and 1.7.0 through 1.7.3, ingestion paths construct file locations directly from untrusted event_id input without validation. A specially crafted event_id can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such input requires access to a valid DSN, potentially exposing them. If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user. This is fixed in versions 1.4.3, 1.5.5, 1.6.4 and 1.7.4.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| bugsink | bugsink | 1.7.0 to before 1.7.4; 1.6.0 to before 1.6.4; 1.5.0 to before 1.5.5; before 1.4.3 | 1.7.4, 1.6.4, 1.5.5, 1.4.3 | Patch available | CNA |
| — | bugsink (PyPI) | 1.7.0 to before 1.7.4 | 1.7.4 | Patch available | GHSA-q78p-g86f-jg6q |
| — | bugsink (PyPI) | 1.6.0 to before 1.6.4 | 1.6.4 | Patch available | GHSA-q78p-g86f-jg6q |
| — | bugsink (PyPI) | 1.5.0 to before 1.5.5 | 1.5.5 | Patch available | GHSA-q78p-g86f-jg6q |
| — | bugsink (PyPI) | before 1.4.3 | 1.4.3 | Patch available | GHSA-q78p-g86f-jg6q |
- bugsink Vendorbugsink Affected 1.7.0 to before 1.7.4; 1.6.0 to before 1.6.4; 1.5.0 to before 1.5.5; before 1.4.3 Fixed in 1.7.4, 1.6.4, 1.5.5, 1.4.3 Patch available CNA
- bugsink (PyPI) Vendor— Affected 1.7.0 to before 1.7.4 Fixed in 1.7.4 Patch available GHSA-q78p-g86f-jg6q
- bugsink (PyPI) Vendor— Affected 1.6.0 to before 1.6.4 Fixed in 1.6.4 Patch available GHSA-q78p-g86f-jg6q
- bugsink (PyPI) Vendor— Affected 1.5.0 to before 1.5.5 Fixed in 1.5.5 Patch available GHSA-q78p-g86f-jg6q
- bugsink (PyPI) Vendor— Affected before 1.4.3 Fixed in 1.4.3 Patch available GHSA-q78p-g86f-jg6q
Remediation
- Fix · CNA bugsink (bugsink) Fixed in 1.7.4, 1.6.4, 1.5.5, 1.4.3
- Fix · GHSA-q78p-g86f-jg6q bugsink (PyPI) Fixed in 1.7.4 Advisory →
- Fix · GHSA-q78p-g86f-jg6q bugsink (PyPI) Fixed in 1.6.4 Advisory →
- Fix · GHSA-q78p-g86f-jg6q bugsink (PyPI) Fixed in 1.5.5 Advisory →
- Fix · GHSA-q78p-g86f-jg6q bugsink (PyPI) Fixed in 1.4.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-54433
- 2026-10-03 Alias added: GHSA-q78p-g86f-jg6q
- 2026-10-31 EPSS moved to the 50th–90th percentile
References
Other 10
- https://github.com/bugsink/bugsink/security/advisories/GHSA-q78p-g86f-jg6q
- https://github.com/bugsink/bugsink/commit/1001726f4389e982c486cdd5fa81941cb46cfc33
- https://github.com/bugsink/bugsink/commit/211ddf76758c808c095b5f836c363f148d934d21
- https://github.com/bugsink/bugsink/commit/2c41fbe3881bdea83399a7f9fdc8cff198ae089f
- https://github.com/bugsink/bugsink/commit/53cf1a17a3e96f7c83c7451fd56f980a09d0c9b0
- https://github.com/bugsink/bugsink/commit/55a155003d0b416ea008c5e7dcde85130ad21d9b
- https://github.com/bugsink/bugsink/commit/b94aa8a5c96ce8cdd9711b6beb4e518264993ac2
- https://github.com/bugsink/bugsink/commit/c341687bd655543730c812db35c29199f788be6b
- https://github.com/bugsink/bugsink/commit/c87217bd565122ba70af90436e3ab2cd9bee658f
- https://github.com/bugsink/bugsink
More bugsink vulnerabilities
- TI-2026-22000 Bugsink is vulnerable to Stored XSS via Pygments fallback in stacktrace rendering CVSS 3.1CRITICAL 9.3
- TI-2025-39901 Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU) CVSS 3.1HIGH 7.5
- TI-2025-39900 Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input CVSS 3.1HIGH 7.5
- TI-2026-28977 Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble CVSS 3.1HIGH 7.1
- TI-2026-38922 Bugsink: DOS using large numbers of event tags CVSS 3.1MEDIUM 4.3
- TI-2026-32436 Bugsink: SSRF bypass in `validate_webhook_url` CVSS 3.1MEDIUM 4.3
Sources
- CVE-2025-54433 · CVE Program
- CVE-2025-54433 · NVD
- FIRST EPSS
- GHSA-q78p-g86f-jg6q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences