CVE-2026-54625 django-cms CVE debrief

Who should care

Defenders managing django CMS deployments, especially those using the page cache feature, should assess their exposure and consider updating to a fixed version. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure in their CMS deployments and plan for remediation.

Why it matters

CVE-2026-54625 allows an unauthenticated attacker to serve arbitrary content to users of django CMS deployments using the page cache feature. Defenders managing django CMS should assess exposure and consider updating to a fixed version.

• An unauthenticated attacker can serve arbitrary content to users.
• The attacker can prime the cache with attacker-chosen content.
• Defenders need to verify exposure in their CMS deployments.
• Remediation requires updating to django CMS version 5.0.8 or 5.1.0.

Technical summary

The django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). This allows an unauthenticated attacker to prime the cache with attacker-chosen content when CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code. The issue is fixed in versions 5.0.8 and 5.1.0. The vulnerability affects django CMS deployments using the page cache feature. Defenders managing django CMS should assess exposure and consider updating to a fixed version.

Defensive priority

Defenders should prioritize verifying exposure in their CMS deployments, especially those using django CMS page cache, and assess the need for updates or compensating controls.

Recommended defensive actions

• Verify if the django CMS page cache is enabled in your deployment.
• Check if any plugins are using get_vary_cache_on() to declare header values.
• Assess the exposure of your CMS deployment to this vulnerability.
• Consider updating to django CMS version 5.0.8 or 5.1.0 if not already done.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in django CMS page cache. The issue allows an unauthenticated attacker to prime the cache with attacker-chosen content when CMS_PAGE_CACHE is enabled and a plugin varies content on a header such as Country-Code.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.