PT-2025-31371 · Bugsink · Bugsink

Vanschelven · Published 2025-07-29 · Updated 2025-07-30 · CVE-2025-54433

Positive Technologies (AI Summary)

CVSS v4.0

7.2

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Bugsink versions 1.4.2 and below Bugsink versions 1.5.0 through 1.5.4 Bugsink versions 1.6.0 through 1.6.3 Bugsink versions 1.7.0 through 1.7.3

Description Bugsink is a self-hosted error tracking service. Ingestion paths construct file locations directly from untrusted event id input without validation. A specially crafted event id can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such input requires access to a valid DSN. If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user.

Recommendations Update to Bugsink version 1.4.3. Update to Bugsink version 1.5.5. Update to Bugsink version 1.6.4. Update to Bugsink version 1.7.4.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-54433

GHSA-Q78P-G86F-JG6Q

Affected Products

Bugsink

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54433.json · Exploit
• https://osv.dev/vulnerability/GHSA-q78p-g86f-jg6q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54433 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54433 · Vendor Advisory
• https://github.com/bugsink/bugsink · Note
• https://github.com/bugsink/bugsink/commit/1001726f4389e982c486cdd5fa81941cb46cfc33 · Note
• https://github.com/bugsink/bugsink/commit/211ddf76758c808c095b5f836c363f148d934d21 · Note
• https://github.com/bugsink/bugsink/commit/c341687bd655543730c812db35c29199f788be6b · Note
• https://github.com/bugsink/bugsink/commit/c87217bd565122ba70af90436e3ab2cd9bee658f · Note
• https://github.com/bugsink/bugsink/security/advisories/GHSA-q78p-g86f-jg6q · Note
• https://github.com/bugsink/bugsink/commit/53cf1a17a3e96f7c83c7451fd56f980a09d0c9b0 · Note
• https://github.com/bugsink/bugsink/commit/b94aa8a5c96ce8cdd9711b6beb4e518264993ac2 · Note
• https://github.com/bugsink/bugsink/commit/55a155003d0b416ea008c5e7dcde85130ad21d9b · Note
• https://github.com/bugsink/bugsink/commit/2c41fbe3881bdea83399a7f9fdc8cff198ae089f · Note
• https://t.me/CVEtracker/28753 · Telegram Post