---
id: CVE-2024-27097
aliases:
  - GHSA-8g38-3m6v-232j
  - PYSEC-2026-1251
title: Potential log injection in reset user endpoint in CKAN
summary: Potential log injection in reset user endpoint in CKAN
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
vendor: ckan
product: ckan
ecosystem: pip
affected:
  - ckan < 2.9.11
  - 'ckan >= 2.10.0, < 2.10.4'
patched:
  - ckan 2.9.11
  - ckan 2.10.4
published: '2024-03-13'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:00.253820756Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-8g38-3m6v-232j'
references:
  - url: 'https://github.com/ckan/ckan/security/advisories/GHSA-8g38-3m6v-232j'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-27097'
  - url: >-
      https://github.com/ckan/ckan/commit/5fa133e7e9019573066455b5d442e93c62b3fc93
  - url: >-
      https://github.com/ckan/ckan/commit/81b56c55e5e3651d7fcf9642cd5a489a9b62212c
  - url: >-
      https://github.com/ckan/ckan/commit/d81f411bff2da7347c343a83e17f5814475b5b64
  - url: 'https://docs.ckan.org/en/2.10/changelog.html#v-2-10-4-2024-03-13'
  - url: 'https://github.com/ckan/ckan'
tags:
  - osv
  - pip
epss: 0.00438
epssPercentile: 0.3534
ingestedAt: '2026-07-08T18:25:47.479Z'
---

## Overview

A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format.

### Patches
This has been fixed in the CKAN 2.9.11 and 2.10.4 versions

### Workarounds
Override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines



## Affected packages

- `ckan < 2.9.11`
- `ckan >= 2.10.0, < 2.10.4`

## Remediation

Upgrade to a patched release:

- `ckan 2.9.11`
- `ckan 2.10.4`