PyPIPackage

ckan

15 known vulnerabilities (1 critical, 3 high, 11 medium), with the versions each affects and the releases that fix them.

Latest release: 2.12.1 (Oct 28, 2026): no advisory affects it
Newest unaffected release: 2.12.1 (Oct 28, 2026), the latest release
Advisories: 15 · 1 critical, 3 high, 11 medium

Weekly downloads: 2,671
Dependents: 33
Releases: 126 since 0.3.0 (Apr 12, 2007)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-42032
Affects 0.3.0 to 2.10.9 (2.10.10 is outside it); 2.11.0 to 2.11.4 (2.11.5 is outside it)
CVE-2026-41255
Affects 2.10.0 to 2.10.9 (2.10.10 is outside it); 2.11.0 to 2.11.4 (2.11.5 is outside it)
CVE-2026-41132
Affects 0.3.0 to 2.10.9 (2.10.10 is outside it); 2.11.0 to 2.11.4 (2.11.5 is outside it)
CVE-2026-42031
Affects 0.3.0 to 2.10.9 (2.10.10 is outside it); 2.11.0 to 2.11.4 (2.11.5 is outside it)
CVE-2025-64100
Affects 2.10.0 to 2.10.8 (2.10.9 is outside it); 2.11.0 to 2.11.3 (2.11.4 is outside it)
CVE-2025-54384
Affects 0.3.0 to 2.10.8 (2.10.9 is outside it); 2.11.0 to 2.11.3 (2.11.4 is outside it)
CVE-2025-24372
Affects 0.3.0 to 2.10.6 (2.10.7 is outside it); 2.11.0 to 2.11.1 (2.11.2 is outside it)
CVE-2024-43371
Affects 0.3.0 to 2.10.4 (2.10.5 is outside it)
CVE-2024-41675
Affects 2.7.0 to 2.10.4 (2.10.5 is outside it)
CVE-2024-41674
Affects 2.0.0 to 2.10.4 (2.10.5 is outside it)
CVE-2024-27097
Affects 0.3.0 to 2.9.10 (2.9.11 is outside it); 2.10.0 to 2.10.3 (2.10.4 is outside it)
CVE-2023-50248
Affects 2.0.0 to 2.9.9 (2.9.10 is outside it); 2.10.0 to 2.10.1 (2.10.3 is outside it)

Show all 15 advisoriesShow fewer advisories

CVE-2023-32321
Affects 0.3.0 to 2.9.8 (2.9.9 is outside it); 2.10.0 (2.10.1 is outside it)
CVE-2022-43685
Affects 0.3.0 to 2.9.6 (2.9.7 is outside it)
CVE-2021-25967
Affects 2.9.0 to 2.9.11 (2.10.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 15

CVE-2026-42032Medium 6.7
CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql`
Affected: fixed in 2.10.10; from 2.11.0, fixed in 2.11.5; fixed in 2.10.10; from 2.11.0, fixed in 2.11.5.
Fixed in 2.10.10 (released Apr 29, 2026, 14 days before disclosure) and 2.11.5 (released Apr 29, 2026, 14 days before disclosure).
The latest release, 2.12.1, is not affected.
CVE-2026-41255Medium 6.1
CKAN: CSRF exemption primed by anonymous requests
Affected: from 2.10.0, fixed in 2.10.10; from 2.11.0, fixed in 2.11.5; from 2.10.0, fixed in 2.10.10; from 2.11.0, fixed in 2.11.5.
Fixed in 2.10.10 (released Apr 29, 2026, 14 days before disclosure) and 2.11.5 (released Apr 29, 2026, 14 days before disclosure).
The latest release, 2.12.1, is not affected.
CVE-2026-41132Medium 6.6
CKAN: No certificate validation on STMP connection
Affected: fixed in 2.10.10; from 2.11.0, fixed in 2.11.5; from 2.11.0, fixed in 2.11.5; fixed in 2.10.10.
Fixed in 2.10.10 (released Apr 29, 2026, 14 days before disclosure) and 2.11.5 (released Apr 29, 2026, 14 days before disclosure).
The latest release, 2.12.1, is not affected.
CVE-2026-42031High 8.3
CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
Affected: fixed in 2.10.10; from 2.11.0, fixed in 2.11.5; fixed in 2.10.10; from 2.11.0, fixed in 2.11.5.
Fixed in 2.10.10 (released Apr 29, 2026, 14 days before disclosure) and 2.11.5 (released Apr 29, 2026, 14 days before disclosure).
The latest release, 2.12.1, is not affected.
CVE-2025-64100Medium 6.1
CKAN Vulnerable to Session Cookie Fixation
Affected: from 2.10.0, fixed in 2.10.9; from 2.11.0, fixed in 2.11.4; from 2.10.0, fixed in 2.10.9; from 2.11.0, fixed in 2.11.4.
Fixed in 2.10.9 (released Oct 29, 2025, the day of disclosure) and 2.11.4 (released Oct 29, 2025, the day of disclosure).
The latest release, 2.12.1, is not affected.
CVE-2025-54384Medium 6.3
CKAN stored XSS vulnerability in Markdown description fields
Affected: fixed in 2.10.9; from 2.11.0, fixed in 2.11.4; from 2.11.0, fixed in 2.11.4; fixed in 2.10.9.
Fixed in 2.10.9 (released Oct 29, 2025, the day of disclosure) and 2.11.4 (released Oct 29, 2025, the day of disclosure).
The latest release, 2.12.1, is not affected.
CVE-2025-24372High 7.3
XSS vector in user uploaded images in group/org and user profiles in ckan
Affected: fixed in 2.10.7; from 2.11.0, fixed in 2.11.2; fixed in 2.10.7; from 2.11.0, fixed in 2.11.2.
Fixed in 2.10.7 (released Feb 5, 2025, the day of disclosure) and 2.11.2 (released Feb 5, 2025, the day of disclosure).
The latest release, 2.12.1, is not affected.
CVE-2024-43371Medium 4.5
Potential access to sensitive URLs via CKAN extensions (SSRF)
Affected: fixed in 2.10.5.
Fixed in 2.10.5 (released Aug 21, 2024, the day of disclosure).
The latest release, 2.12.1, is not affected.
CVE-2024-41675Medium 6.8
CKAN has a Cross-site Scripting vector in the Datatables view plugin
Affected: from 2.7.0, fixed in 2.10.5.
Fixed in 2.10.5 (released Aug 21, 2024, the day of disclosure).
The latest release, 2.12.1, is not affected.
CVE-2024-41674Medium 5.3
CKAN may leak Solr credentials via error message in package_search action
Affected: from 2.0.0, fixed in 2.10.5.
Fixed in 2.10.5 (released Aug 21, 2024, the day of disclosure).
The latest release, 2.12.1, is not affected.
CVE-2024-27097Medium 4.3
Potential log injection in reset user endpoint in ckan
Affected: fixed in 2.9.11; from 2.10.0, fixed in 2.10.4; fixed in 2.9.11; from 2.10.0, fixed in 2.10.4.
Fixed in 2.9.11 (released Mar 13, 2024, the day of disclosure) and 2.10.4 (released Mar 13, 2024, the day of disclosure).
The latest release, 2.12.1, is not affected.
CVE-2023-50248Medium 4.5
CKAN out of memory error when submitting the dataset form with a specially-crafted field
Affected: from 2.0, fixed in 2.9.10; from 2.10.0, fixed in 2.10.3; from 2.0, fixed in 2.9.10; from 2.10.0, fixed in 2.10.3.
Fixed in 2.9.10 (released Dec 13, 2023, the day of disclosure) and 2.10.3 (released Dec 13, 2023, the day of disclosure).
The latest release, 2.12.1, is not affected.
CVE-2023-32321Critical 9.8
CKAN remote code execution and private information access via crafted resource ids
Affected: fixed in 2.9.9; from 2.10.0, fixed in 2.10.1.
Fixed in 2.9.9 (released May 24, 2023, 2 days before disclosure) and 2.10.1 (released May 24, 2023, 2 days before disclosure).
The latest release, 2.12.1, is not affected.
CVE-2022-43685High 8.8
CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request.
Affected: fixed in 2.9.7.
Fixed in 2.9.7 (released Oct 26, 2022, 27 days before disclosure).
The latest release, 2.12.1, is not affected.
CVE-2021-25967Medium 5.4
CKAN - Stored Cross-Site Scripting (XSS) via SVG File Upload
Affected: from 2.9.0, fixed in 2.10.0; from 2.9.0, fixed in 2.9.4.
Fixed in 2.10.0 (released Feb 15, 2023, 441 days after disclosure).
The latest release, 2.12.1, is not affected.