CVE-2026-125105

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 7.0.9 Wagtail versions prior to 7.3.4 Wagtail versions prior to 7.4.3 Wagtail versions prior to 8.0rc2

Description Wagtail applies ETag conditional request processing to the document serve endpoint before completing document permission and filename checks. An unauthenticated attacker who possesses a document ID and a candidate SHA1 hash can use the If-Match or If-None-Match HTTP headers to determine if that specific hash exists within the document library. This issue does not expose document contents, filenames, other metadata, or information regarding hashes unknown to the attacker.

Recommendations Update to version 7.0.9. Update to version 7.3.4. Update to version 7.4.3. Update to version 8.0rc2. As a temporary workaround, strip If-Match and If-None-Match headers from anonymous requests to the /documents/ endpoint at the reverse proxy. As a temporary workaround, use a custom document model that does not include a file hash attribute.