Django Security Advisory: 4 CVEs Including SSRF, DoS, and XSS

Django Security Vulnerabilities Summary Vulnerability Overview 1. CVE-2026-15307: Server-side file write and request forgery via spatial lookups - Description: Spatial lookups allowed passing and lookup values to when they represented rasters. This could result in writing files to disk (potentially enabling remote code execution in some cases) or making network requests on behalf of the Django process user. Since the admin change list allows filtering via , any registered user with view permissions could access any registered model containing spatial fields. - Fix: The following types of spatial lookups are now prohibited: - - values that are not valid objects, such as serialized dictionaries 2. CVE-2026-15337: Potential denial-of-service vulnerability in - Description: was vulnerable to potential denial-of-service attacks when checking many different and very long language codes. Each code was used as a key in an in-memory cache, consuming process memory. - Fix: Language codes exceeding 500 characters are now rejected before performing cache lookups. 3. CVE-2026-15830: Potential denial-of-service vulnerability via nested geometry collections - Description: was vulnerable to potential denial-of-service attacks when provided with deeply nested objects, leading to segmentation faults in GEOS. - Fix: A maximum depth of 198 s is now enforced for the WKT format, and a total maximum count of 198 s (combining width and depth) is enforced for the WKB format. 4. CVE-2026-15920: Potential cross-site scripting (XSS) vulnerability in admin values - Description: The admin rendered values as clickable links in the change list view and in readonly fields. These links were generated without validating whether the value was a safe URL, meaning stored values could be rendered as links. - Fix: values are now validated using via . If validation fails, the value is displayed as plain text. Affected Versions Django main Django 6.1 (currently in Release Candidate status) Django 6.0 Django 5.2 Remediation Django 6.0.8 and Django 5.2.17 have been released with fixes for the above vulnerabilities. Patches have been applied to the main, 6.1 (currently in Release Candidate status), 6.0, and 5.2 branches of Django. The patches can be obtained via the following commits: - CVE-2026-15307: - On the main branch - On the 6.1 branch - On the 6.0 branch - On the 5.2 branch - CVE-2026-15337: - On the main branch - On the 6.1 branch - On the 6.0 branch - On the 5.2 branch - CVE-2026-15830: - On the main branch - On the 6.1 branch - On the 6.0 branch - On the 5.2 branch - CVE-2026-15920: - On the main branch - On the 6.1 branch - On the 6.0 branch - On the 5.2 branch Release Information Django 6.0.8 (tarball Django 5.2.17 (tarball General Security Reporting Instructions Please report potential security issues via private email to , rather than through Django Trac instances or Django forums. Please refer to our security policy for more information. Code Blocks No POC or exploit code available.

Goal Reached Thanks to every supporter — we hit 100%!

Django Security Advisory: 4 CVEs Including SSRF, DoS, and XSS