CVE-2026-40162: Bugsink 2.1.0 Authenticated Arbitrary File Write Vulnerability
Summary
CVE-2026-40162: Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble. Affects bugsink versions >= 2.1.0, < 2.1.1. Fixed in 2.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bugsink is an open-source tool designed for managing and processing application artifacts. It allows users to assemble and manage bundles of artifacts efficiently. However, version 2.1.0 of Bugsink has been identified to have a critical vulnerability that permits authenticated users to write arbitrary files to the filesystem, potentially compromising the integrity of the application.
Vulnerability Detail
The vulnerability in Bugsink arises from improper handling of file write operations during the artifact bundle assembly process. An authenticated user with a valid token can exploit this flaw to write malicious content to any filesystem location that the Bugsink process has permission to access. This could lead to various consequences, including modification of application data files, corruption of uploaded assets, and disruption of normal application behavior. The vulnerability specifically affects version 2.1.0 and is addressed in version 2.1.1.
How To Fix
Latest published version: 2.6.2 as of 23 Oct 2026
pip install --upgrade "bugsink==2.6.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.1
This is the first release that contains the fix.
pip install --upgrade "bugsink==2.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, ensure that the Bugsink process runs with the minimum required filesystem permissions to limit the impact of this vulnerability. This can help reduce the risk of unauthorized file writes.
Conclusion
The authenticated arbitrary file write vulnerability in Bugsink 2.1.0 poses significant risks to application integrity. Users are strongly advised to upgrade to version 2.1.1 to mitigate these risks. Additionally, employing proper filesystem permissions can serve as a temporary workaround until the upgrade is completed.
See every vulnerability recorded for bugsink →
FAQ
The vulnerability allows authenticated users to write arbitrary files to locations writable by the Bugsink service account, potentially compromising application integrity.
Only version 2.1.0 of Bugsink is affected by this vulnerability. Version 2.1.1 has the fix.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application's Pipfile.lock against the vulnerability using the Vulert playground at Vulert Scanner.
Consequences may include modification of application data files, corruption of uploaded assets, and disruption of normal application behavior.
The CVSS score for this vulnerability is 7.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for bugsink.
