CVE-2025-54433 Bugsink is vulnerable to Path Traversal attacks via event_id in ingestion
Attackers with valid DSN access can overwrite or create arbitrary files via path traversal in event_id, potentially compromising the host system.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-54433?
CVE-2025-54433 is a high-severity path traversal vulnerability in bugsink, published on 30 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 through 1.6.3, and 1.7.0 through 1.7.3, ingestion paths construct file locations directly from untrusted event_id input without validation. A specially crafted event_id can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such input requires access to a valid DSN, potentially exposing them. If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user. This is fixed in versions 1.4.3, 1.5.5, 1.6.4 and 1.7.4.
Weakness: CWE-22
Which versions are affected by CVE-2025-54433?
9 open source packages ship an affected version, including bugsink.
| Package | Affected | Fixed in |
|---|---|---|
bugsink PyPI | All versions | 1.4.3, 1.5.5, 1.6.4, 1.7.4, 1.6.4 |
bugsink PyPI | All versions | 1.4.3 |
bugsink PyPI | All versions | 1.4.3 |
bugsink PyPI | From 1.5.0 | 1.5.5 |
bugsink PyPI | From 1.5.0 | 1.5.5 |
bugsink PyPI | From 1.6.0 | 1.6.4 |
3 more packages
bugsink PyPI | From 1.6.0 | 1.6.4 |
bugsink PyPI | From 1.7.0 | 1.7.4 |
bugsink PyPI | From 1.7.0 | 1.7.4 |
How do I fix CVE-2025-54433?
Upgrade bugsink to a fixed version for your release line: 1.4.3, 1.5.5, 1.6.4 or 1.7.4.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-54433 being exploited?
There is no known exploitation of CVE-2025-54433 in the wild and no public exploit code.
Sources
Also known as GHSA-q78p-g86f-jg6q, PYSEC-2026-1226.