CVSS 3.1
7.1 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:LCVE-2026-40162
High (7.1) in bugsink bugsink. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in bugsink 2.1.1.
Bugsink is a self-hosted error tracking tool. In 2.1.0, an authenticated file write vulnerability was identified in Bugsink 2.1.0 in the artifact bundle assembly flow. A user with a valid authentication token could cause the application to write attacker-controlled content to a filesystem location writable by the Bugsink process. This vulnerability is fixed in 2.1.1.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- bugsink:bugsink
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8hw4-fhww-273g | PyPI | bugsink | >=2.1.0 <2.1.1 | 2.1.1 |
| PYSEC-2026-2404 | PyPI | bugsink | >=2.1.0 <2.1.1 | 2.1.1 |