Input validation error in Django - CVE-2026-15307
Published: August 5, 2026
Vulnerability identifier: #VU140942
CSH Severity: Low
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-15307
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to write files to disk or issue network requests as the Django process user.
The vulnerability exists due to improper input validation in spatial lookups when processing lookup values that are passed to GDALRaster. A remote user can supply a specially crafted lookup value to write files to disk or issue network requests as the Django process user.
The issue was reachable through the admin changelist for staff users with view permissions on any registered model containing a spatial field.
Affected software
Django
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Package Hub 15
openSUSE Leap
python311-Django
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Package Hub 15
openSUSE Leap
python311-Django
How to mitigate CVE-2026-15307
Install security update from vendor's website.
Django - addressed in versions 5.2.17, 6.0.8
python311-Django - update to 4.2.11-150600.3.65.1
python311-Django - update to 4.2.11-150600.3.65.1