PatchTheCVEescriptorium vulnerabilities and fixes
Recent CVEs affecting escriptorium, with upgrade or downgrade steps. 5 tracked.
escriptorium has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-08-06. Highest priority: CVE-2026-18258 (score 42/100).
- CVE-2026-18258 HIGH 8.8 UPGRADE Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scrip
- CVE-2026-18359 HIGH 8.5 UPGRADE Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 a
- CVE-2026-18277 HIGH 7.1 UPGRADE Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 all
- CVE-2026-18275 MEDIUM 6.5 UPGRADE Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.
- CVE-2026-18276 MEDIUM 4.3 UPGRADE Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authen
FAQ
How do I fix escriptorium vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is escriptorium being exploited right now?
None of the tracked escriptorium CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which escriptorium CVE should I patch first?
CVE-2026-18258 currently ranks highest (42/100): Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scrip.