The vulnerability in bunkerweb involves improper input validation of authenticated Host headers in the UI and API components. This occurs in a configuration-dependent path where user-controlled input is not properly neutralized, enabling low-privileged authenticated users to escalate privileges. The flaw affects bunkerweb versions prior to 1.6.12 and bunkerweb PRO versions prior to 0.57. The CVSS 4.0 base score is 6.1, indicating medium severity. No known exploits in the wild have been reported. The vendor has released fixed versions 1.6.12 and 0.57 to address this issue.

A low-privileged authenticated user can exploit this improper input validation to escalate privileges, potentially compromising confidentiality, integrity, and availability of the bunkerweb instance. This could allow unauthorized access or modification of sensitive configurations or data within the affected system.

Upgrade bunkerweb to version 1.6.12 or later, or bunkerweb PRO to version 0.57 or later, where this vulnerability has been fixed. No other official remediation guidance is provided. Patch status is confirmed by the vendor's versioning information.