Impact
Sentry instances with the relocation feature enabled are vulnerable to remote code execution via unsafe deserialization in a legacy database field. An authenticated user can submit a crafted relocation archive that triggers arbitrary code execution in the import worker process.
Self-hosted instances using default configuration are not affected as the relocation feature is disabled by default.
Patches
Fixed in 26.7.0. The fix removes the serialization of the unsafe database field.
Workarounds
If you cannot upgrade immediately, ensure the relocation feature is disabled (this is the default):
- Verify
relocation.enabled is set to False
- Verify
relocation.daily-limit.small, relocation.daily-limit.medium, and relocation.daily-limit.large are set to 0
Either condition blocks exploitation.
References
Attribution
This issue was found with the help of Arthur Chan, David Korczynski and Adam Korczynski from Ada Logics and Anthropic Claude.
arthurscchan Reporter
DavidKorczynski Reporter
AdamKorcz Reporter
Impact
Sentry instances with the relocation feature enabled are vulnerable to remote code execution via unsafe deserialization in a legacy database field. An authenticated user can submit a crafted relocation archive that triggers arbitrary code execution in the import worker process.
Self-hosted instances using default configuration are not affected as the relocation feature is disabled by default.
Patches
Fixed in 26.7.0. The fix removes the serialization of the unsafe database field.
Workarounds
If you cannot upgrade immediately, ensure the relocation feature is disabled (this is the default):
relocation.enabledis set to Falserelocation.daily-limit.small,relocation.daily-limit.medium, andrelocation.daily-limit.largeare set to 0Either condition blocks exploitation.
References
Attribution
This issue was found with the help of Arthur Chan, David Korczynski and Adam Korczynski from Ada Logics and Anthropic Claude.