Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-15307: Django GeoDjango can let attackers write files or run code
CVE-2026-15307 · published 1 month ago
Summary
Versions of Django 5.2 before 5.2.17 and 6.0 before 6.0.8 let a user who can view the admin area send specially crafted map queries that cause the system to create or modify files and contact external servers. This can allow an attacker to run their own code on the server. Update Django to the latest 5.2.17 or 6.0.8 releases (or later) to fix the issue.
What to do
- Update djangoproject django to version 6.0.8 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | djangoproject | django | < 6.0.8 |
| Debian:11 | debian | python-django | All versions |
| Debian:12 | debian | python-django | All versions |
| Debian:13 | debian | python-django | All versions |
| Debian:14 | debian | python-django | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | python-django | All versions |
Original advisory text
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.g...
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15307... Vendor Advisory
- https://pypi.org/project/Django/ Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-15307 Vendor Advisory
- https://github.com/django/django/ URL
- https://docs.djangoproject.com/en/dev/releases/security/ Third Party Advisory
- https://github.com/django/django/commit/208f80cb682868b584ed0a78f23e4ba6304212aa Third Party Advisory
- https://github.com/django/django/commit/115ffd0463a765ab1cc93de18e94b5459b8a300e Third Party Advisory
- https://www.djangoproject.com/weblog/2026/aug/04/security-releases/ Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-15307 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-15307 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-15307 Third Party Advisory
- https://github.com/django/django/commit/39b3e2d0c743a338def6c473086ebc06865e86b6 Third Party Advisory
- https://github.com/django/django/commit/f1949c1f9758947ade984c895ff16bef46f56520 Third Party Advisory
- https://groups.google.com/g/django-announce Third Party Advisory
Severity
9.4
Critical
CVSS 3.1: 8.8 (MITRE)
CVSS 4.0: 9.4 (OSV)
Exploitation
EPSS 1%
Type
CWE-73External Control of File Name or Path
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published4 Aug 2026
Updated27 Sep 2026
First seen4 Aug 2026
Sources
CVE-2026-15307 · OSV
CVE-2026-15307 · NVD
CVE-2026-15307 · MITRE
DEBIAN-CVE-2026-15307 · OSV
UBUNTU-CVE-2026-15307 · OSV
Track software like this
Free during beta