SecuriTricks - CVE-2026-40162

Description

Bugsink is a self-hosted error tracking tool. In 2.1.0, an authenticated file write vulnerability was identified in Bugsink 2.1.0 in the artifact bundle assembly flow. A user with a valid authentication token could cause the application to write attacker-controlled content to a filesystem location writable by the Bugsink process. This vulnerability is fixed in 2.1.1.

Product(s) Impacted

Vendor	Product	Versions
Bugsink	Bugsink	2.1.0, 2.1.1

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	bugsink	bugsink	2.1.0	/	/	/	/	/	/	/
a	bugsink	bugsink	2.1.1	/	/	/	/	/	/	/

References

https://github.com/bugsink/bugsink/releases/tag/2.1.1

https://github.com/bugsink/bugsink/security/advisories/GHSA-8hw4-fhww-273g

CVSS Score

7.1 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: HIGH
Availability Impact: LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

View Vector String

Timeline

Published: April 10, 2026, 6:16 p.m.
Last Modified: April 10, 2026, 6:16 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

CVE-2026-40162