CVE-2026-40162

CVE-2026-40162 is an authenticated file write vulnerability affecting Bugsink 2.1.0, a self-hosted error tracking application. An attacker with valid authentication credentials can exploit a flaw in the artifact bundle assembly flow to write arbitrary content to filesystem locations accessible by the Bugsink process. This vulnerability has been patched in version 2.1.1. The vulnerability carries a CVSS 3.1 score of 7.1 (HIGH) with a network-based attack vector requiring low complexity and authenticated access, but no user interaction. The primary impact is integrity compromise through arbitrary file writes, with secondary availability degradation possible. The FAUCET risk score of 37.0 out of 100 indicates moderate concern. Regarding exploitation status, this vulnerability is not currently being exploited in the wild. It does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog and is marked as inactive on threat tracking lists. The extremely low EPSS score of 0.00095 suggests minimal probability of exploitation in real-world environments. Organizations running Bugsink should prioritize upgrading to version 2.1.1 as a routine patch management task rather than an emergency response.