CVE-2024-39317

Date: July 11, 2024

Wagtail is an open source content management system built on Django. A bug in Wagtail's "parse_query_string" would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, "parse_query_string" would take an unexpectedly large amount of time to process, resulting in a denial of service. In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses "parse_query_string", it may be exploitable by other users (e.g. unauthenticated users). Patched versions have been released as Wagtail 5.2.6, 6.0.6 and 6.1.3.

Language: Python