Vulnerability in Django's GeoDjango Spatial Lookups Affecting Multiple Versions
CVE-2026-15307

8.7HIGH

Key Information:

Vendor

Djangoproject

Status
Django
Vendor
CVE Published:
4 August 2026

What is CVE-2026-15307?

A flaw in Django's GeoDjango allows untrusted input to be processed as a raster during spatial lookups. This issue can lead to writing files with attacker-specified names and contents via a file-backed GDAL driver. Consequently, this may permit remote code execution if the file is later imported by the application. The vulnerability affects Django versions 5.2 prior to 5.2.17 and 6.0 prior to 6.0.8, as well as older unsupported versions that may not have been assessed for this risk.

Affected Version(s)

Django 6.0 < 6.0.8

Django 5.2 < 5.2.17

Django 6.0.8

References

https://docs.djangoproject.com/en/dev/releases/security/
vendor-advisory
https://groups.google.com/g/django-announce
mailing-list
https://github.com/django/django/commit/f1949c1f9758947ad...
patch

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bence Nagy, localhost-detect, and kimchunbok_
Jacob Walls
Natalia Bidart
.