Django GIS RasterField Vulnerability Analysis (CVE-2026-15307)

Vulnerability Overview Vulnerability ID: CVE-2026-15307 Description: This vulnerability involves blocking raster strings and dictionaries in spatial lookups. Spatial lookups optimistically treat parameter values as rasters rather than converting them to geometry objects before passing them to the raster constructor. If a malicious value reaches the raster constructor, it may write to disk or fetch from the network depending on the raster driver, regardless of the default parameter of the constructor. Affected Scope Affected Components: Django's module, specifically . Specific Impact: - Spatial lookups allow and type values to be passed to when they represent rasters. - Depending on the raster driver, this may write to disk (enabling remote code execution in some cases) or make network requests (as the Django process user). - Because the admin change list allows filtering, lookups for become exploitable by any user with view permissions for registered models that contain spatial fields. Remediation Fix Details: - Block raster strings and dictionaries in spatial lookups. - Allow these types if the user chooses to wrap the value in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . - Import in . -

Goal Reached Thanks to every supporter — we hit 100%!

Django GIS RasterField Vulnerability Analysis (CVE-2026-15307)

More from this source