Bugsink, a self-hosted error tracking tool, contains an issue in the artifact bundle assembly process that allows an authenticated attacker to write arbitrary content to any file system location that the Bugsink process can write to. This flaw is due to insufficient validation of user input (CWE‑20). Consequently, a malicious user with a valid authentication token could overwrite configuration files, deploy malicious scripts, or otherwise alter the system, potentially compromising confidentiality, integrity, or availability.

The vulnerability affects Bugsink version 2.1.0. All deployments running this version are at risk. The issue was fixed in Bugsink 2.1.1, so upgrades to that version or later eliminate the flaw.

The CVSS score of 7.1 indicates a high‑severity risk. Because the flaw requires authentication, the attack vector is confined to legitimate users or compromised accounts; nevertheless, any token holder can exploit the vulnerability. EPSS data is unavailable, so the exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Organizations should treat this as a high‑risk flaw capable of enabling significant system damage if not remedied promptly.