Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54625— django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

Quick assessment

Affected
django-cms django-cms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

django CMS 是一个基于 Django 的内容管理系统。在版本 5.0.8 之前以及 5.1.0a1 版本中，django CMS 的页面缓存机制（位于 cms/cache/page.py）会忽略插件通过 get_vary_cache_on() 方法声明的请求头。_page_cache_key 函数生成的缓存键仅包含缓存前缀、站点、语言、路径和时区，而未包含这些声明的头部字段值。尽管 set_page_cache 方法会将这些头部名称添加到响应的 Vary 头中，但 get_page_cache 方法在检索

CVSS 4.8 · Medium EPSS 0.15% · P4

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProduct Version RangeStatus
django-cms django-cms < 5.0.8 affected
>= 5.1.0a1, < 5.1.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54625

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
Source: CVE Program / CVE List V5
Vulnerability Description
django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache prefix, site, language, path, and timezone but not the declared header values. Although set_page_cache adds those names to the response Vary header, get_page_cache retrieves the first stored variant under the same header-agnostic key. When CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code, one visitor can receive another visitor’s request-specific content, and an unauthenticated attacker can prime the cache with attacker-chosen content. This issue is fixed in versions 5.0.8 and 5.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在可信数据中接受外来的不可信数据
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
django-cms django-cms < 5.0.8 -

II. Public POCs for CVE-2026-54625

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54625

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54625 (4)

Vendor Advisories for CVE-2026-54625 (1)

Same Patch Batch · django-cms · 2026-08-20 · 7 CVEs total

CVE-2026-54623 7.1 HIGH django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
CVE-2026-54622 6.5 MEDIUM django CMS: Clipboard copy IDOR discloses unauthorized plugin content
CVE-2026-54624 6.5 MEDIUM django CMS: Structure endpoint bypasses page-view permission
CVE-2026-63003 6.5 MEDIUM django CMS: Broken access control in page *Duplicate* allows reading the content of any pa
CVE-2026-75526 4.4 MEDIUM django CMS: Stored XSS in edit-mode plugin exception rendering
CVE-2026-61663 4.3 MEDIUM django CMS: Missing authorization in `render_object_structure` discloses non-PageContent p

IV. Related Vulnerabilities

Same product: django-cms
Same vendor: django-cms
Same weakness: CWE-349

V. Comments for CVE-2026-54625

No comments yet

Leave a comment