GHSA-Q78P-G86F-JG6Q
Vulnerability from github – Published: 2025-07-29 20:13 – Updated: 2025-07-30 15:42
VLAI?
Summary
Bugsink path traversal via event_id in ingestion
Details
Summary
In affected versions, ingestion paths construct file locations directly from untrusted event_id input without validation. A specially crafted event_id can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations.
Submitting such input requires access to a valid DSN. While that limits exposure, DSNs are sometimes discoverable—for example, when included in frontend code—and should not be treated as a strong security boundary.
Impact
A valid DSN holder can craft an event_id that causes the ingestion process to write files outside its designated directory. This allows overwriting files accessible to the user running Bugsink.
If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user.
Mitigation
Update to version 1.7.4, 1.6.4, 1.5.5 or 1.4.3 , which require event_id to be a valid UUID and normalizes it before use in file paths.
Severity ?
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "bugsink"
},
"ranges": [
{
"events": [
{
"introduced": "1.7.0"
},
{
"fixed": "1.7.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "bugsink"
},
"ranges": [
{
"events": [
{
"introduced": "1.6.0"
},
{
"fixed": "1.6.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "bugsink"
},
"ranges": [
{
"events": [
{
"introduced": "1.5.0"
},
{
"fixed": "1.5.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "bugsink"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-54433"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-29T20:13:51Z",
"nvd_published_at": "2025-07-30T15:15:35Z",
"severity": "HIGH"
},
"details": "## Summary\n\nIn affected versions, ingestion paths construct file locations directly from untrusted `event_id` input without validation. A specially crafted `event_id` can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations.\n\nSubmitting such input requires access to a valid DSN. While that limits exposure, DSNs are sometimes discoverable\u2014for example, when included in frontend code\u2014and should not be treated as a strong security boundary.\n\n## Impact\n\nA valid DSN holder can craft an `event_id` that causes the ingestion process to write files outside its designated directory. This allows overwriting files accessible to the user running Bugsink.\n\nIf Bugsink runs in a container, the effect is confined to the container\u2019s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user.\n\n## Mitigation\n\nUpdate to version `1.7.4`, `1.6.4`, `1.5.5` or `1.4.3` , which require `event_id` to be a valid UUID and normalizes it before use in file paths.",
"id": "GHSA-q78p-g86f-jg6q",
"modified": "2025-07-30T15:42:22Z",
"published": "2025-07-29T20:13:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/bugsink/bugsink/security/advisories/GHSA-q78p-g86f-jg6q"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54433"
},
{
"type": "WEB",
"url": "https://github.com/bugsink/bugsink/commit/1001726f4389e982c486cdd5fa81941cb46cfc33"
},
{
"type": "WEB",
"url": "https://github.com/bugsink/bugsink/commit/211ddf76758c808c095b5f836c363f148d934d21"
},
{
"type": "WEB",
"url": "https://github.com/bugsink/bugsink/commit/2c41fbe3881bdea83399a7f9fdc8cff198ae089f"
},
{
"type": "WEB",
"url": "https://github.com/bugsink/bugsink/commit/53cf1a17a3e96f7c83c7451fd56f980a09d0c9b0"
},
{
"type": "WEB",
"url": "https://github.com/bugsink/bugsink/commit/55a155003d0b416ea008c5e7dcde85130ad21d9b"
},
{
"type": "WEB",
"url": "https://github.com/bugsink/bugsink/commit/b94aa8a5c96ce8cdd9711b6beb4e518264993ac2"
},
{
"type": "WEB",
"url": "https://github.com/bugsink/bugsink/commit/c341687bd655543730c812db35c29199f788be6b"
},
{
"type": "WEB",
"url": "https://github.com/bugsink/bugsink/commit/c87217bd565122ba70af90436e3ab2cd9bee658f"
},
{
"type": "PACKAGE",
"url": "https://github.com/bugsink/bugsink"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Bugsink path traversal via event_id in ingestion"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…