PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-15920 Djangoproject CVE debrief

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue. The CVE record was published on 2026-08-04T17:16:46.733Z and has not been modified since then. The NVD entry is currently Analyzed. To verify and mitigate this vulnerability, defenders should review the official Django security release notes and patches, validate URLField values before rendering them in the admin interface, and use ModelForm or admin validation to reject unsafe URL schemes.

Vendor
Djangoproject
Product
Django
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-04
Original CVE updated
2026-08-17
Advisory published
2026-08-04
Advisory updated
2026-08-17

Who should care

Django developers and administrators who use the Django admin interface are at risk and should take immediate action to protect their applications. This includes reviewing and applying available patches for Django versions 5.2 and 6.0, validating URLField values before rendering them in the admin interface, and using ModelForm or admin validation to reject unsafe URL schemes. Additionally, staff users who interact with the Django admin interface are at risk of cross-site scripting attacks when clicking on links rendered from unvalidated URLField values.

Technical summary

The `django.contrib.admin.utils.display_for_field()` function renders URLField values as clickable links in the admin interface without proper validation. This allows for cross-site scripting attacks against staff users who click on links rendered from unvalidated URLField values stored in the database. The vulnerability affects Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8. To mitigate this vulnerability, developers should validate URLField values before rendering them in the admin interface and use ModelForm or admin validation to reject unsafe URL schemes.

Defensive priority

Staff users who interact with the Django admin interface are at risk of cross-site scripting attacks when clicking on links rendered from unvalidated URLField values.

Recommended defensive actions

  • Review and apply available patches for Django versions 5.2 and 6.0
  • Validate URLField values before rendering them in the admin interface
  • Use ModelForm or admin validation to reject unsafe URL schemes
  • Monitor for suspicious activity on staff user accounts
  • Consider implementing additional security measures for the admin interface

Evidence notes

The CVE record and NVD details indicate that Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8 are affected by a cross-site scripting vulnerability in the admin interface due to improper validation of URLField values. The vulnerability allows for cross-site scripting attacks against staff users who click on links rendered from unvalidated URLField values stored in the database. To verify and mitigate this vulnerability, defenders should review the official Django security release notes and patches, validate URLField values before rendering them in the admin interface, and use ModelForm or admin validation to reject unsafe URL schemes.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-04T17:16:46.733Z and has not been modified since then.