Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-54728— bunkerweb: Improper Input Validation and Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in BunkerWeb

Quick assessment

Affected

bunkerity bunkerweb

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Bunkerity BunkerWeb是Bunkerity团队开源的一个开源 Web 应用程序防火墙。 Bunkerity BunkerWeb存在输入验证错误漏洞，该漏洞源于BunkerWeb UI和API中已验证的Host标头处理在配置相关路径中验证和清理用户输入不当，可能导致低权限已验证用户提升权限，影响BunkerWeb实例的机密性、完整性和可用性。

AI Predicted 8.1 Difficulty: Easy EPSS 0.38% · P32 Updated Jul 17, 2026

Possible ATT&CK Techniques 1 AI

T1078.004 · Cloud Accounts

Affected Version Matrix 1

Vendor	Product	Version Range	Status
bunkerity	bunkerweb	`< 1.6.12`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54728

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

bunkerweb: Improper Input Validation and Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in BunkerWeb

Source: CVE Program / CVE List V5

Vulnerability Description

bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). Prior to BunkerWeb 1.6.12 and BunkerWeb PRO 0.57, authenticated Host header handling in the BunkerWeb UI and API improperly validated and neutralized user-controlled input in a configuration-dependent path, allowing a low-privileged authenticated user to escalate privileges and affect confidentiality, integrity, and availability of the BunkerWeb instance. This issue is fixed in BunkerWeb version 1.6.12 and BunkerWeb PRO version 0.57.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

输入验证不恰当

Source: CVE Program / CVE List V5

Vulnerability Title

Bunkerity BunkerWeb 输入验证错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
bunkerity	bunkerweb	< 1.6.12	-

II. Public POCs for CVE-2026-54728

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-54728

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-54728 (1)

🔗 Authenticated privilege escalation via Host header handling in BunkerWeb UI and API · Advisory · bunkerity/bunkerweb · GitHub Read full article x_refsource_CONFIRM

Vendor Pages for CVE-2026-54728 (1)

🔗 Release v1.6.12 · bunkerity/bunkerweb · GitHub x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-54728

IV. Related Vulnerabilities

Same product: bunkerweb

Same vendor: bunkerity

Same weakness: CWE-20