Django Patches Four High-Severity Vulnerabilities in Versions 6.0.8 and 5.2.17

Key Takeaways

• Django has issued urgent security updates, versions 6.0.8 and 5.2.17, addressing four vulnerabilities in its Python web framework.
• The most critical flaw, CVE-2026-15307, is a high-severity issue in spatial lookups that could lead to file writes or network requests, potentially enabling remote code execution.
• Other patches resolve denial-of-service risks (CVE-2026-15337, CVE-2026-15830) and a stored cross-site scripting vulnerability (CVE-2026-15920).
• Developers are advised to upgrade immediately, particularly those utilizing Django GIS features or the built-in administrative interface.

Django Bolsters Security with Critical Patches for Web Framework

The Django development team has released crucial security updates, Django 6.0.8 and Django 5.2.17, to mitigate four security vulnerabilities impacting supported iterations of the popular Python web framework. These patches are vital for maintaining the integrity and security of applications built on Django.

System administrators and developers are strongly encouraged to implement these upgrades without delay, especially in environments where Django GIS functionalities or the integrated administrative interface are accessible to staff members.

High-Severity Flaw in Spatial Lookups Addressed

The most pressing concern, identified as CVE-2026-15307, carries a high-severity rating. This vulnerability affects Django’s spatial lookups, specifically when processing raster-related values through GDALRaster.

Historically, these spatial lookups could interpret both string and dictionary values as valid raster representations. Depending on the specific raster driver in use, a malicious input could potentially trigger an unauthorized file write on the server or initiate a network request, leveraging the permissions of the Django process itself.

In certain configurations, this file-write capability presented a pathway for remote code execution. The vulnerability was particularly relevant within Django admin changelists, where staff users with view permissions could exploit filtering options on registered models containing spatial fields.

To counteract this, Django now explicitly blocks dictionary values and strings that do not conform to valid GEOSGeometry objects from being used in spatial lookups. This security enhancement may necessitate adjustments for applications that previously relied on these input types.

Django clarified that model field assignments continue to accept these input types without change. Developers managing untrusted spatial data are advised to implement validation prior to use and to consult Django’s raster security guidelines before attempting to reintroduce similar functionality in custom code.

Additional Vulnerabilities Patched

Another issue, CVE-2026-15337, resolves a low-severity denial-of-service (DoS) risk found in django.utils.translation.check_for_language(). This function had the potential to store an excessive number of distinct and lengthy language codes within an in-memory cache.

An attacker could exploit this by submitting long values via POST requests to the optional set_language() view, leading to a gradual consumption of server memory.

While Django’s request-size settings and a maximum cache-entry count offered some mitigation against memory impact, the update now prevents language codes exceeding 500 characters from reaching the cached lookup, thereby reducing unnecessary memory usage.

A further denial-of-service vulnerability, CVE-2026-15830, impacts applications that utilize geographic geometry processing. This flaw centered on deeply nested GEOMETRYCOLLECTION objects, which could trigger a segmentation fault in the underlying GEOS library.

Such an issue could enable an attacker to disrupt a Django application if specially crafted geometry input were passed to spatial field lookups or a GeometryField form field.

The corrective measures now impose a limit of 198 nested geometry collections for well-known text input. For well-known binary input, Django limits the total count of geometry collections to 198. Developers requiring a different threshold can adjust the new max_geom_collections setting available in GEOSGeometry, as well as in relevant form fields and model fields. GeoJSON inputs are unaffected by this particular vulnerability due to their parsing by GDAL.

The fourth identified issue, CVE-2026-15920, addresses a moderate-severity stored cross-site scripting (XSS) risk within Django admin views. Previously, URLField values were rendered as clickable links in changelists and read-only admin fields without proper validation of the URL scheme, leaving them susceptible to malicious input.

A stored value employing an unsafe scheme could therefore appear as an active, exploitable link. Django now validates URLField values using URLValidator before rendering them as links, displaying invalid values as plain text instead.

These critical fixes have also been incorporated into Django’s main development branch and the Django 6.1 release candidate branch. Organizations are strongly advised to update their Django deployments promptly, thoroughly test spatial lookup compatibility, and review existing admin access controls and input validation procedures.

What You Should Do

• Immediately Upgrade: Apply the Django 6.0.8 or Django 5.2.17 security releases to all affected Django deployments.
• Prioritize GIS/Admin Exposure: Give special attention to upgrades for systems that expose Django GIS features or the built-in admin interface to users.
• Validate Spatial Data: For applications handling untrusted spatial data, implement robust validation routines before processing.
• Review Raster Security: Consult Django’s updated raster security guidance if you previously relied on custom handling of spatial data that might be affected by the changes.
• Test Compatibility: After upgrading, thoroughly test any applications utilizing spatial lookups to ensure continued functionality.
• Reinforce Admin Controls: Review and strengthen access controls for Django admin interfaces and general input validation practices across your applications.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.