Django Vulnerability in SpatialReference Leading to Potential Server-Side Requests
CVE-2026-114582

6.9MEDIUM

Key Information:

Vendor

Djangoproject

Status
Django
Vendor
CVE Published:
3 November 2026

What is CVE-2026-114582?

A vulnerability exists in Django's django.contrib.gis.gdal.SpatialReference module, where the lack of restrictions on GDAL’s file and network access enables attackers to exploit crafted spatial reference strings. This flaw permits unauthorized server-side requests or local file reads, posing significant security risks. Earlier unsupported Django versions may also be vulnerable, highlighting the importance of thorough version management and timely updates.

Affected Version(s)

Django 6.1 < 6.1.3

Django 6.0 < 6.0.10

Django 5.2 < 5.2.19

References

https://docs.djangoproject.com/en/dev/releases/security/
vendor-advisory
https://groups.google.com/g/django-announce
mailing-list
https://github.com/django/django/commit/3a2ec4378b53c7b8f...
patch

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adraca
Jake Howard
Jacob Walls
Jacob Walls
Sarah Boyce
David Smith
Jacob Walls
.