PyPI/wagtail CVE-2026-54260: low 2.7, EPSS 0.37%

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, an authenticated admin user can trigger expensive rendition processing with purposeful

Action: Upgrade wagtail to 7.0.8 or later.

pip install wagtail==7.0.8

pip install wagtail==7.3.3

pip install wagtail==7.4.2

Affected

introduced	fixed	last affected
0	7.0.8	-
7.1	7.3.3	-
7.4	7.4.2	-

Fixed versions

7.0.8

7.3.3

7.4.2

Sources

osv: PYSEC-2026-613
https://github.com/wagtail/wagtail/security/advisories/GHSA-f2p5-j6fg-5cxf

CVE-2026-54260 · published 2026-07-01T22:16:49.523Z · modified 2026-07-03T13:45:08.251414710Z · JSON