Vulnerability in django CMS Affects Plugin Management Functionality

CVE-2026-54623

What is CVE-2026-54623?

In django CMS, prior to version 5.0.8, a vulnerability exists within the move_plugin endpoint that allows an attacker to manipulate plugin hierarchy. The endpoint accepts an unvalidated plugin_parent value, enabling the potential creation of a parent_id cycle within the plugin tree, which can lead to infinite recursion during tree rendering processes. This could ultimately exhaust server resources, corrupt the plugin structure, and disrupt normal operations. The issue has been resolved in version 5.0.8, which introduces appropriate validation measures.

References