CVE-2026-125105: Wagtail: Identification of documents by SHA1 hash
Impact By passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library.
This vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash.
Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.
Workarounds Site owners who are unable to upgrade can strip If-Match and If-None-Match from anonymous requests to /documents/ at the reverse proxy, or use a custom document model without a filehash attribute.
Acknowledgements Many thanks to Anand Himanshu for reporting this issue.
For more information If you have any questions or comments about this advisory:
Visit Wagtail's support channels Email us at security@wagtail.org (view our security policy for more information).
Other sources
Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, Wagtail applies ETag conditional request processing to the document serve endpoint before document permission and filename checks complete. An unauthenticated attacker who knows a document ID and a candidate SHA1 hash can submit If-Match or If-None-Match and distinguish the response, revealing whether that hash is present in the document library. The issue does not expose document contents, filenames, other metadata, or information about hashes the attacker does not already know. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.3.4 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.4.3 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 8.0rc2 - Upgrade
Upgrade
Wagtailto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
Wagtailto a version that resolves this vulnerability.Fixed in 7.3.4 - Upgrade
Upgrade
Wagtailto a version that resolves this vulnerability.Fixed in 7.4.3 - Upgrade
Upgrade
Wagtailto a version that resolves this vulnerability.Fixed in 8.0rc2 - Configuration
Use a custom document model without a file_hash attribute.
Wagtail custom document model file_hash attribute = absent - Compensating control
At the reverse proxy, strip If-Match and If-None-Match headers from anonymous requests to /documents/.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must be able to send specific HTTP headers to the document serve URL and must already know both a document ID and the SHA1 hash they want to test. No authentication or user interaction is required, but the attack has high complexity.
What information can be disclosed?
An attacker can determine whether a document with a specified ID matches a known SHA1 hash, even when permissions would otherwise restrict access. The issue does not reveal document contents, filenames, other metadata, or information about documents whose SHA1 hashes are not already known.
Which releases contain fixes?
Patched releases are Wagtail 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
What can be done if upgrading is not immediately possible?
At the reverse proxy, strip the If-Match and If-None-Match headers from anonymous requests to /documents/. Alternatively, use a custom document model that does not have a file_hash attribute.