GHSA-8hw4-fhww-273g · Severity: high · Ecosystem: pip — Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble
Bugsink is a self-hosted error tracking tool. In 2.1.0, an authenticated file write vulnerability was identified in Bugsink 2.1.0 in the artifact bundle assembly flow. A user with a valid authentication token could cause the application to write attacker-controlled content to a filesystem location writable by the Bugsink process. This vulnerability is fixed in 2.1.1.
Conclusion & alert: CVE-2026-40162 is rated Low Risk (37/100): CVSS High severity, with low exploitation likelihood (EPSS 0.08%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-04-11 | — | 0.08% | — |
Full EPSS history (1 record total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.1 | 3.1 | HIGH |
|
2.8 | 4.2 | [email protected] |
GHSA-8hw4-fhww-273g · Severity: high · Ecosystem: pip — Bugsink affected by authenticated arbitrary file write in artifactbundle/assemble
| URL | Tags |
|---|---|
| https://github.com/bugsink/bugsink/releases/tag/2.1.1 | Product Release Notes |
| https://github.com/bugsink/bugsink/security/advisories/GHSA-8hw4-fhww-273g | Mitigation Vendor Advisory |