{"id":"CVE-2025-54433","state":"PUBLISHED","title":"Bugsink is vulnerable to Path Traversal attacks via event_id in ingestion","description":"Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 through 1.6.3, and 1.7.0 through 1.7.3,  ingestion paths construct file locations directly from untrusted event_id input without validation. A specially crafted event_id can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such input requires access to a valid DSN, potentially exposing them. If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user. This is fixed in versions 1.4.3, 1.5.5, 1.6.4 and 1.7.4.","publishedAt":"2025-07-30T14:29:03.510Z","updatedAt":"2025-07-30T14:46:51.691Z","severity":{"score":7.2,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["bugsink bugsink"],"affected":[{"vendor":"bugsink","product":"bugsink","versions":[{"version":">= 1.7.0, < 1.7.4","status":"affected"},{"version":">= 1.6.0, < 1.6.4","status":"affected"},{"version":">= 1.5.0, < 1.5.5","status":"affected"},{"version":"< 1.4.3","status":"affected"}]}],"references":["https://github.com/bugsink/bugsink/security/advisories/GHSA-q78p-g86f-jg6q","https://github.com/bugsink/bugsink/commit/1001726f4389e982c486cdd5fa81941cb46cfc33","https://github.com/bugsink/bugsink/commit/211ddf76758c808c095b5f836c363f148d934d21","https://github.com/bugsink/bugsink/commit/2c41fbe3881bdea83399a7f9fdc8cff198ae089f","https://github.com/bugsink/bugsink/commit/53cf1a17a3e96f7c83c7451fd56f980a09d0c9b0","https://github.com/bugsink/bugsink/commit/55a155003d0b416ea008c5e7dcde85130ad21d9b","https://github.com/bugsink/bugsink/commit/b94aa8a5c96ce8cdd9711b6beb4e518264993ac2","https://github.com/bugsink/bugsink/commit/c341687bd655543730c812db35c29199f788be6b","https://github.com/bugsink/bugsink/commit/c87217bd565122ba70af90436e3ab2cd9bee658f"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:09:31.862Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/54xxx/CVE-2025-54433.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-54433","state":"PUBLISHED","datePublished":"2025-07-30T14:29:03.510Z","dateUpdated":"2025-07-30T14:46:51.691Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2025-07-21T23:18:10.282Z"},"containers":{"cna":{"title":"Bugsink is vulnerable to Path Traversal attacks via event_id in ingestion","descriptions":[{"lang":"en","value":"Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 through 1.6.3, and 1.7.0 through 1.7.3,  ingestion paths construct file locations directly from untrusted event_id input without validation. A specially crafted event_id can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such input requires access to a valid DSN, potentially exposing them. If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user. This is fixed in versions 1.4.3, 1.5.5, 1.6.4 and 1.7.4."}],"affected":[{"vendor":"bugsink","product":"bugsink","versions":[{"version":">= 1.7.0, < 1.7.4","status":"affected"},{"version":">= 1.6.0, < 1.6.4","status":"affected"},{"version":">= 1.5.0, < 1.5.5","status":"affected"},{"version":"< 1.4.3","status":"affected"}]}],"references":[{"url":"https://github.com/bugsink/bugsink/security/advisories/GHSA-q78p-g86f-jg6q","name":"https://github.com/bugsink/bugsink/security/advisories/GHSA-q78p-g86f-jg6q","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/bugsink/bugsink/commit/1001726f4389e982c486cdd5fa81941cb46cfc33","name":"https://github.com/bugsink/bugsink/commit/1001726f4389e982c486cdd5fa81941cb46cfc33","tags":["x_refsource_MISC"]},{"url":"https://github.com/bugsink/bugsink/commit/211ddf76758c808c095b5f836c363f148d934d21","name":"https://github.com/bugsink/bugsink/commit/211ddf76758c808c095b5f836c363f148d934d21","tags":["x_refsource_MISC"]},{"url":"https://github.com/bugsink/bugsink/commit/2c41fbe3881bdea83399a7f9fdc8cff198ae089f","name":"https://github.com/bugsink/bugsink/commit/2c41fbe3881bdea83399a7f9fdc8cff198ae089f","tags":["x_refsource_MISC"]},{"url":"https://github.com/bugsink/bugsink/commit/53cf1a17a3e96f7c83c7451fd56f980a09d0c9b0","name":"https://github.com/bugsink/bugsink/commit/53cf1a17a3e96f7c83c7451fd56f980a09d0c9b0","tags":["x_refsource_MISC"]},{"url":"https://github.com/bugsink/bugsink/commit/55a155003d0b416ea008c5e7dcde85130ad21d9b","name":"https://github.com/bugsink/bugsink/commit/55a155003d0b416ea008c5e7dcde85130ad21d9b","tags":["x_refsource_MISC"]},{"url":"https://github.com/bugsink/bugsink/commit/b94aa8a5c96ce8cdd9711b6beb4e518264993ac2","name":"https://github.com/bugsink/bugsink/commit/b94aa8a5c96ce8cdd9711b6beb4e518264993ac2","tags":["x_refsource_MISC"]},{"url":"https://github.com/bugsink/bugsink/commit/c341687bd655543730c812db35c29199f788be6b","name":"https://github.com/bugsink/bugsink/commit/c341687bd655543730c812db35c29199f788be6b","tags":["x_refsource_MISC"]},{"url":"https://github.com/bugsink/bugsink/commit/c87217bd565122ba70af90436e3ab2cd9bee658f","name":"https://github.com/bugsink/bugsink/commit/c87217bd565122ba70af90436e3ab2cd9bee658f","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","lang":"en","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2025-07-30T14:29:03.510Z"},"source":{"advisory":"GHSA-q78p-g86f-jg6q","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-30T14:46:38.151753Z","id":"CVE-2025-54433","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-07-30T14:46:51.691Z"}}]}}}