CVE-2026-15307
Received Received - Intake

Path Traversal in Django GeoDjango Spatial Lookups

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: Django Software Foundation

Description
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-15307
EUVD
EUVD-2026-52747

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
django django to 5.2.17 (exc)
django django to 6.0.8 (exc)
django django 5.1
django django 5.0
django django 4.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-15307 is a high-severity vulnerability in Django's GeoDjango spatial lookups. It allows server-side file-write and request forgery attacks when untrusted input reaches the GDALRaster constructor through spatial lookups. Staff users with view permissions in the Django admin could exploit this via the changelist filtering to write files or make network requests, potentially leading to remote code execution.

Detection Guidance

Check Django versions for affected releases (5.2 before 5.2.17, 6.0 before 6.0.8). Inspect admin changelist queries for spatial field lookups using strings or dictionaries. Review GDALRaster constructor usage in application logs for unexpected file writes or network requests.

Impact Analysis

If exploited, this vulnerability could allow an attacker with Django admin view permissions to write arbitrary files to the server or make outbound network requests. This may lead to remote code execution if the attacker writes a malicious file that gets executed later. The impact depends on the server's configuration and the attacker's goals.

Compliance Impact

This vulnerability could lead to unauthorized file writes or network requests, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. Unauthorized access or data exfiltration may result in compliance breaches, fines, or legal consequences depending on the affected data and jurisdiction.

Mitigation Strategies

Upgrade Django to patched versions (5.2.17+ or 6.0.8+). Block spatial lookups using string or dictionary inputs in admin interfaces. Validate all spatial lookup inputs to ensure they are GEOSGeometry objects or explicitly wrapped GDALRaster objects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15307. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart