CVE-2020-11001: Possible XSS attack in Wagtail
Summary
CVE-2020-11001: Possible XSS attack in Wagtail. Affects wagtail across 2 version ranges.
>= 1.9.0, < 2.7.2
>= 2.8.0, < 2.8.1
Fixed in 2.7.2 or 2.8.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wagtail is an open-source content management system (CMS) written in Python. It provides a user-friendly interface for managing website content and is widely used for building websites and web applications. The vulnerability identified as CVE-2020-11001 affects versions 1.9.0 to 2.7.1 and 2.8.0 of Wagtail. This vulnerability allows a user with limited-permission editor account to craft a malicious page revision history that, when viewed by a user with higher privileges, can execute actions using the higher privileged user's credentials. It is important to note that this vulnerability can only be exploited by a user with access to the Wagtail admin interface and is not exploitable by ordinary site visitors.
Vulnerability Detail
The vulnerability in Wagtail is a cross-site scripting (XSS) vulnerability that exists specifically on the page revision comparison view within the Wagtail admin interface. This means that an attacker with a limited-permission editor account can manipulate the page revision history to inject malicious code. When a user with higher privileges views this manipulated revision history, the malicious code can be executed, potentially leading to unauthorized actions being performed using the higher privileged user's credentials. The impact of this vulnerability can be significant as it allows an attacker to gain unauthorized access and perform actions on behalf of higher privileged users.
How To Fix
Latest published version: 8.0.1 as of 23 Oct 2026
pip install --upgrade "wagtail==8.0.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.9.0, < 2.7.22.7.2pip install --upgrade "wagtail==2.7.2" -
>= 2.8.0, < 2.8.12.8.1pip install --upgrade "wagtail==2.8.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the patched versions is not immediately feasible, site owners can disable the revision comparison view as a temporary workaround. This can be done by adding the following URL route to the top of the project's urls.py configuration:
from django.views.generic.base import RedirectView
urlpatterns = [
url(r'^admin/pages/(\d+)/revisions/compare/', RedirectView.as_view(url='/admin/')),
# ...
]
This workaround redirects requests to the revision comparison view to the admin dashboard, effectively disabling the vulnerable functionality.
Conclusion
The XSS vulnerability in Wagtail's page revision comparison view poses a potential security risk for sites using affected versions. It is crucial to upgrade to the patched versions (Wagtail 2.7.2 or 2.8.1) to mitigate this vulnerability. If immediate upgrading is not possible, the provided workaround can be implemented to disable the vulnerable functionality. Regularly monitoring for security updates and promptly applying them is essential to maintain the security of Wagtail installations.
See every vulnerability recorded for wagtail →
FAQ
This vulnerability affects Wagtail versions 1.9.0 to 2.7.1 and 2.8.0. Site owners who have users with limited-permission editor accounts and higher privileged users accessing the Wagtail admin interface are potentially at risk.
No, this vulnerability can only be exploited by users with access to the Wagtail admin interface. Ordinary site visitors without access to the admin interface are not able to exploit this vulnerability.
An attacker can craft a malicious page revision history that, when viewed by a user with higher privileges, can perform actions using the higher privileged user's credentials. This can include unauthorized content modifications, access to restricted functionality, or even administrative control of the Wagtail instance.
There are no known instances of this vulnerability being exploited in the wild. However, it is important to apply the necessary patches or workarounds to mitigate the risk.
For more information or support regarding this vulnerability, you can visit Wagtail's support channels at https://docs.wagtail.io/en/stable/support.html or email them at security@wagtail.io.
References
Related vulnerabilities
Recent vulnerabilities recorded for wagtail.
