Bugsink up to 1.4.2/1.5.4/1.6.3/1.7.3 event_id path traversal

Summaryinfo

A vulnerability was found in Bugsink up to 1.4.2/1.5.4/1.6.3/1.7.3 and classified as critical. Affected by this issue is some unknown functionality. Such manipulation of the argument event_id leads to path traversal. This vulnerability is listed as CVE-2025-54433. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Bugsink up to 1.4.2/1.5.4/1.6.3/1.7.3 and classified as critical. Affected by this issue is an unknown code. The manipulation of the argument event_id with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is integrity, and availability. CVE summarizes:

Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 through 1.6.3, and 1.7.0 through 1.7.3, ingestion paths construct file locations directly from untrusted event_id input without validation. A specially crafted event_id can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such input requires access to a valid DSN, potentially exposing them. If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user. This is fixed in versions 1.4.3, 1.5.5, 1.6.4 and 1.7.4.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-54433 since 07/22/2025. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 1.4.3, 1.5.5, 1.6.4 or 1.7.4 eliminates this vulnerability. Applying the patch 1001726f4389e982c486cdd5fa81941cb46cfc33 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Bugsink

Version

• 1.4.0
• 1.4.1
• 1.4.2
• 1.5.0
• 1.5.1
• 1.5.2
• 1.5.3
• 1.5.4
• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.7.0
• 1.7.1
• 1.7.2
• 1.7.3

License

• open-source

Website

• Product: https://github.com/bugsink/bugsink/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion