CVE-2026-40162
Received Received - Intake
Authenticated File Write Vulnerability in Bugsink 2.1.0 Allows Arbitrary File Modification

Publication date: 2026-04-10

Last updated on: 2026-04-15

Assigner: GitHub, Inc.

Description
Bugsink is a self-hosted error tracking tool. In 2.1.0, an authenticated file write vulnerability was identified in Bugsink 2.1.0 in the artifact bundle assembly flow. A user with a valid authentication token could cause the application to write attacker-controlled content to a filesystem location writable by the Bugsink process. This vulnerability is fixed in 2.1.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-10
Last Modified
2026-04-15
Generated
2026-05-07
AI Q&A
2026-04-10
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
bugsink bugsink 2.1.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

CVE-2026-40162 is an authenticated arbitrary file write vulnerability found in Bugsink version 2.1.0, specifically in the artifact bundle assembly process.

An attacker with a valid authentication token can exploit this flaw to write attacker-controlled content to filesystem locations writable by the Bugsink process.

The issue arises because checksum values were used in path construction before validation, allowing a write-before-checksum-mismatch condition.

This vulnerability was fixed in version 2.1.1 by validating checksum values before using them in path construction.


How can this vulnerability impact me? :

The impact depends on the deployment environment and the filesystem permissions of the Bugsink service account.

Potential consequences include modification or corruption of application data files, uploaded assets, temporary files, or overwriting files in mounted writable volumes.

Such unauthorized file writes can disrupt normal application behavior.

No unauthenticated exploitation or direct code execution has been demonstrated, but the risk may increase if the process has broad write permissions.

Mitigation involves upgrading to Bugsink version 2.1.1 and ensuring the Bugsink process operates with minimum necessary filesystem permissions.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, you should upgrade Bugsink to version 2.1.1, which contains the fix for the authenticated arbitrary file write issue.

Additionally, ensure that the Bugsink process runs with the minimum necessary filesystem permissions to reduce the risk of exploitation.


How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability affects Bugsink version 2.1.0 and involves an authenticated arbitrary file write during the artifact bundle assembly process. Detection involves verifying the Bugsink version running on your system and checking for signs of unauthorized file writes by authenticated users.

To detect if your system is vulnerable, first identify the Bugsink version:

  • Check the Bugsink version by running a command or inspecting the application metadata, for example: `bugsink --version` or checking the version in the application UI or configuration files.

If version 2.1.0 is detected, the system is vulnerable and should be upgraded to 2.1.1.

To detect exploitation attempts, monitor filesystem locations writable by the Bugsink process for unexpected or attacker-controlled file writes, especially during artifact bundle assembly operations.

Suggested commands to help detect suspicious file writes (assuming Linux environment and appropriate permissions):

  • Use `lsof` to list open files by the Bugsink process: `lsof -c bugsink`
  • Monitor filesystem changes in writable directories using `inotifywait`: `inotifywait -m /path/to/bugsink/writable/dir`
  • Check recent file modifications: `find /path/to/bugsink/writable/dir -type f -mtime -1` to find files modified in the last day.
  • Review application logs for suspicious authenticated requests that may trigger file writes.

Ultimately, upgrading to Bugsink 2.1.1 is the recommended mitigation to prevent exploitation.


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

The provided information does not explicitly address how the authenticated arbitrary file write vulnerability in Bugsink 2.1.0 affects compliance with common standards and regulations such as GDPR or HIPAA.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart