Input validation error in Django - CVE-2026-15307

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU140942

Input validation error in Django - CVE-2026-15307

Published: August 5, 2026


Vulnerability identifier: #VU140942
CSH Severity: Low
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-15307
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to write files to disk or issue network requests as the Django process user.

The vulnerability exists due to improper input validation in spatial lookups when processing lookup values that are passed to GDALRaster. A remote user can supply a specially crafted lookup value to write files to disk or issue network requests as the Django process user.

The issue was reachable through the admin changelist for staff users with view permissions on any registered model containing a spatial field.


Affected software

Django
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Package Hub 15
openSUSE Leap
openEuler
Fedora
python311-Django
python-django
python-django-help
python3-Django
python-django5

How to mitigate CVE-2026-15307

Install security update from vendor's website.

Django - addressed in versions 5.2.17, 6.0.8
python311-Django - update to 4.2.11-150600.3.65.1
python-django - update to 4.2.15-18
python-django-help - update to 4.2.15-18
python3-Django - update to 4.2.15-18
python-django5 - addressed in versions 5.2.17-2.fc43, 5.2.17-2.fc44, 5.2.17-2.fc45

External References

Related Security Bulletins