CVE-2025-54433: Path Traversal in Bugsink

The core of this vulnerability lies in the direct construction of file paths from the eventid input without proper validation. A malicious eventid can be crafted to escape the intended directory, enabling an attacker to write files to unexpected locations on the system. While a valid DSN is required, the potential for DSN discovery, particularly through frontend code exposure, significantly broadens the attack surface. Successful exploitation could lead to data corruption, privilege escalation (depending on file permissions), and potentially even remote code execution if sensitive configuration files are overwritten.

1. Reserved2025-07-21
2. Published2025-07-29
3. Modified2025-07-30
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-54433 is to upgrade Bugsink to version 1.7.4 or later, which includes the necessary input validation to prevent path traversal. If immediate upgrading is not feasible, consider implementing stricter access controls on the DSN to limit potential attackers. Review frontend code for any accidental exposure of DSN credentials. Implement a Web Application Firewall (WAF) rule to filter requests containing suspicious characters in the eventid parameter. After upgrading, verify the fix by attempting to submit a crafted eventid designed to traverse outside the intended directory; the ingestion process should reject the request.