{"action":"Upgrade wagtail to 7.0.8 or later.","affected":[{"fixed":"7.0.8","introduced":"0"},{"fixed":"7.3.3","introduced":"7.1"},{"fixed":"7.4.2","introduced":"7.4"}],"component":"wagtail","cve_ids":["CVE-2026-54259"],"ecosystem":"PyPI","epss":0.0027,"exploited":false,"fixed_versions":["7.0.8","7.3.3","7.4.2"],"ghsa_id":"GHSA-h54r-xq46-qwqm","id":"tcs_01M5KHCENSS5J7QG8WBB6D9JM0","modified_at":"2026-07-03T13:45:07.103483502Z","published_at":"2026-07-01T22:16:49.297Z","references":["https://osv.dev/vulnerability/PYSEC-2026-612","https://github.com/wagtail/wagtail/security/advisories/GHSA-h54r-xq46-qwqm"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-612","url":"https://osv.dev/vulnerability/PYSEC-2026-612"}],"summary":"Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, the Documents and Images chooser's chosen endpoint incorrectly listed items for which"}