https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:47:43 +0000 https://db.gcve.eu/vuln/cve-2026-40162 <p><strong>Affected:</strong> bugsink</p> <p>Bugsink is a self-hosted error tracking tool. In 2.1.0, an authenticated file write vulnerability was identified in Bugsink 2.1.0 in the artifact bundle assembly flow. A user with a valid authentication token could cause the application to write attacker-controlled content to a filesystem location writable by the Bugsink process. This vulnerability is fixed in 2.1.1.</p> <p><strong>Affected:</strong> bugsink</p> <p>Bugsink is a self-hosted error tracking tool. In 2.1.0, an authenticated file write vulnerability was identified in Bugsink 2.1.0 in the artifact bundle assembly flow. A user with a valid authentication token could cause the application to write attacker-controlled content to a filesystem location writable by the Bugsink process. This vulnerability is fixed in 2.1.1.</p> https://db.gcve.eu/vuln/cve-2026-40162 https://db.gcve.eu/vuln/pysec-2026-2404 <p><strong>Affected:</strong> PyPI: bugsink</p> <p># Authenticated arbitrary file write in artifact bundle assembly</p> <p>## Summary</p> <p>An authenticated file write vulnerability was identified in Bugsink **2.1.0** in the artifact bundle assembly flow.</p> <p>A user with a valid authentication token could cause the application to write attacker-controlled content to a filesystem location writable by the Bugsink process.</p> <p>This issue requires authentication and affects only version **2.1.0**.</p> <p>The issue is fixed in **2.1.1**.</p> <p>## Impact</p> <p>This vulnerability allows an authenticated user to create or overwrite files **within locations writable by the Bugsink service account**.</p> <p>The practical impact depends on the deployment environment and filesystem permissions of the running process.</p> <p>Possible consequences include:</p> <p>* modification of application data files * corruption of uploaded assets or temporary files * overwriting files in mounted writable volumes * disruption of normal application behavior</p> <p>No unauthenticated exploitation is known.</p> <p>No direct code execution has been demonstrated as part of this issue, though impact may be greater in deployments where the process has broad write permissions.</p> <p>## Affected versions</p> <p>* **Affected:** 2.1.0 * **Fixed:** 2.1.1 * **Not affected:** earlier releases</p> <p>## Mitigation</p> <p>Upgrade to **2.1.1**.</p> <p>As a defense-in-depth measure, deployments should continue to ensure the Bugsink process runs with the **minimum required filesystem permissions**.</p> <p><strong>Affected:</strong> PyPI: bugsink</p> <p># Authenticated arbitrary file write in artifact bundle assembly</p> <p>## Summary</p> <p>An authenticated file write vulnerability was identified in Bugsink **2.1.0** in the artifact bundle assembly flow.</p> <p>A user with a valid authentication token could cause the application to write attacker-controlled content to a filesystem location writable by the Bugsink process.</p> <p>This issue requires authentication and affects only version **2.1.0**.</p> <p>The issue is fixed in **2.1.1**.</p> <p>## Impact</p> <p>This vulnerability allows an authenticated user to create or overwrite files **within locations writable by the Bugsink service account**.</p> <p>The practical impact depends on the deployment environment and filesystem permissions of the running process.</p> <p>Possible consequences include:</p> <p>* modification of application data files * corruption of uploaded assets or temporary files * overwriting files in mounted writable volumes * disruption of normal application behavior</p> <p>No unauthenticated exploitation is known.</p> <p>No direct code execution has been demonstrated as part of this issue, though impact may be greater in deployments where the process has broad write permissions.</p> <p>## Affected versions</p> <p>* **Affected:** 2.1.0 * **Fixed:** 2.1.1 * **Not affected:** earlier releases</p> <p>## Mitigation</p> <p>Upgrade to **2.1.1**.</p> <p>As a defense-in-depth measure, deployments should continue to ensure the Bugsink process runs with the **minimum required filesystem permissions**.</p> https://db.gcve.eu/vuln/pysec-2026-2404