Do Son 
TL;DR
The Django team shipped security releases 6.0.8 and 5.2.17 on August 4, 2026. They fix four flaws, led by a high-severity Django vulnerability, CVE-2026-15307. In some setups, it can enable remote code execution. All Django users should upgrade now.
- Product: djangoproject Django
- Vulnerabilities: 4 flaws (CVE-2026-15307, CVE-2026-15337, CVE-2026-15830, CVE-2026-15920)
- Highest severity: 8.8 (High · CVSSv3)
- Worst impact: Server-side file-write and request forgery via spatial lookups
- Status: No confirmed exploitation yet; patches available
- Action: Update to 6.0.8, 5.2.17 now
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-15307 | 8.8 | Server-side file-write and request forgery via spatial lookups | 6.0.8, 5.2.17 | Not exploited |
| CVE-2026-15920 | 6.1 | Potential cross-site scripting via URLField values in the admin | 6.0.8, 5.2.17 | Not exploited |
| CVE-2026-15337 | 5.3 | Potential denial-of-service in check_for_language() | 6.0.8, 5.2.17 | Not exploited |
| CVE-2026-15830 | 5.3 | Potential denial-of-service via nested geometry collections | 6.0.8, 5.2.17 | Not exploited |
Why it matters
Django powers a large share of Python web applications. This Django vulnerability hits GeoDjango, its geospatial toolkit. Sites that expose spatial fields in the admin face the most risk. The bug also allows server-side request forgery, not just file writes. An attacker could make the server send requests to internal systems. That can expose cloud metadata or other hidden services. Many mapping and location apps rely on GeoDjango, so the reach is broad.
How the attack works
CVE-2026-15307 lives in Django’s spatial lookups. The advisory explains that certain values passed to GDALRaster “could write a file to disk (in some cases enabling remote code execution) or issue a network request as the Django process user.” An attacker abuses how rasters get parsed. Notably, the flaw is not fully unauthenticated. It is reachable by staff users with view permissions on any model that has a spatial field. Admin changelist filtering provides the path. The impact depends on which raster driver is active. Some drivers turn a file write into code execution. Others only allow the network request. Either way, the code runs with the Django service’s own permissions. In response, Django now blocks dict values and unsafe string values in spatial lookups. This is a backward-incompatible change.
The other three fixes
CVE-2026-15830 is a moderate denial-of-service bug. Deeply nested geometry collections could crash the GEOS library. CVE-2026-15920 is a moderate stored cross-site scripting flaw in the admin. It rendered unsafe URLField links without validation. CVE-2026-15337 is a low-severity denial-of-service issue in language-code handling. Django now caps geometry-collection depth at 198 and validates URL schemes in the admin.
Exploitation status
Django has not reported any exploitation in the wild. In addition, no public proof-of-concept has surfaced so far.
Affected versions
The flaws affect Django main, Django 6.1 (release candidate), Django 6.0, and Django 5.2.
Patch and mitigation
Upgrade to Django 6.0.8 or 5.2.17 without delay. Also validate all untrusted input before use, as the team advises. The spatial-lookup change may break some queries, so review the raster security guidance first. For full details and changesets, read the official Django security release.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
