NetSight
IP …
high7.1

CVE-2025-54433

Bugsink path traversal via event_id in ingestion

Impact

## Summary In affected versions, ingestion paths construct file locations directly from untrusted `event_id` input without validation. A specially crafted `event_id` can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such input requires access to a valid DSN. While that limits exposure, DSNs are sometimes discoverable—for example, when included in frontend code—and should not be treated as a strong security boundary. ## Impact A valid DSN holder can craft an `event_id` that causes the ingestion process to write files outside its designated directory. This allows overwriting files accessible to the user running Bugsink. If Bugsink runs in a container, the effect is confined to the container’s filesystem. In non-containerized setups, the overwrite may affect other parts of the system accessible to that user. ## Mitigation Update to version `1.7.4`, `1.6.4`, `1.5.5` or `1.4.3` , which require `event_id` to be a valid UUID and normalizes it before use in file paths.

Affected packages

EcosystemPackageAffectedFixed in
pipbugsink>= 1.7.0, < 1.7.41.7.4

Affected products

ProductAffected versions
Versions 1.4.2 And Below, 1.5.0
through 1.5.4
1.6.0
through 1.6.3
And 1.7.0
through 1.7.3

Versions were read from the advisory text. No structured product data has been published for this record yet.

Weakness classification

CWE-22

References