CVE-2026-15307 djangoproject CVE debrief

Who should care

Developers and administrators using Django 5.2 before 5.2.17 and 6.0 before 6.0.8, especially those with staff users having view permission in Django admin, should be aware of this vulnerability and take necessary actions to mitigate it.

Technical summary

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution.

Defensive priority

Staff users with view permission in Django admin can be impacted by this vulnerability, which allows remote code execution through file writing and outbound network requests.

Recommended defensive actions

• Review and apply Django security updates to ensure the system is running version 5.2.17 or 6.0.8 or later.
• Restrict access to Django admin to trusted users only.
• Monitor for suspicious network requests and file writes.
• Consider implementing additional security measures such as Web Application Firewalls (WAFs) and intrusion detection systems.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record was published on 2026-08-04T17:16:46.127Z and has not been modified since then. The NVD entry is currently Received. Official references include CVE.org, NVD, and multiple GitHub commits.

Official resources