CVE-2026-15307Patch(djangoproject / django)

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch djangoproject django systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.

djangoproject CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Vendor / third-party advisories

https://www.djangoproject.com/weblog/2026/aug/04/security-releases/

Other references

https://groups.google.com/g/django-announce

Weakness type (CWE)

CWE-73CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

django

Threat summary

Patch or workaround signal is available
11 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 9 signals
Technical details provided in 11 signals
Disclosure: 2 classified signals
Peaked 3d ago at 6 mentions (2026-08-05); latest day: 1
11 total mentions across 5 days

Affected systems

Vendors

djangoproject

Products

django

Deep dive

Activity timeline11 mentions / 5d

Signal classification2 categories

Patch

981.8%

Disclosure

218.2%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-04	1	Patch1
2026-08-05	6	Disclosure2Patch4
2026-08-06	2	Patch2
2026-08-07	1	Patch1
2026-08-20	1	Patch1

Full discourse11 posts

The Hacker News@TheHackersNews45d
Patch
🚨 Veeam, Terraform MCP, and Django patched 11 flaws exposing credentials, crossing tenant boundaries, and enabling file writes. Veeam fixed CVE-2026-58073, which can expose managed-agent credentials without authentication, and CVE-2026-58072, a file-write flaw that can lead to RCE. HashiCorp patched CVE-2026-16498 and CVE-2026-16496, which can break tenant isolation in Terraform MCP Server, plus SSRF flaw CVE-2026-14869. Django fixed CVE-2026-15307, a GeoDjango flaw that can write files and, on some setups, lead to code execution. See what needs patching: https://thehackernews.com/2026/08/veeam-terraform-mcp-django-patch.html
Post summary
The notice announces that Veeam, HashiCorp (Terraform MCP), and Django have released patches for several critical CVEs, detailing the nature of each vulnerability and providing a link for further information.
3171582625.4K
2.3M followersView on X
Daily CyberSecurity@Daily_CyberSec46d
Patch
A high-severity Django vulnerability, CVE-2026-15307, can enable remote code execution through spatial lookups. Update to Django 6.0.8 or 5.2.17 now. #Django #DjangoSecurity #CVE202615307 #RCE #RemoteCodeExecution #Vulnerability #Python #WebSecurity https://securityonline.info/django-vulnerability-cve-2026-15307-rce/ https://t.co/R3JIViIldP
Post summary
The tweet reports a high‑severity RCE vulnerability (CVE‑2026‑15307) affecting Django and urges users to update to the latest patched versions.
01002571.3K
12.9K followersView on X
ThreatWire@ThreatWire_46d
Disclosure
🚨 CVE-2026-15307: A high-severity Django vulnerability could enable remote code execution (RCE) through spatial lookups. #Django #RCE #CVE #CyberSecurity
Post summary
The tweet announces CVE‑2026‑15307, a high‑severity remote code execution flaw in Django that exploits spatial lookup functionality.
1311831.4K
1.4K followersView on X
Netlas.io@Netlas_io46d
Disclosure
CVE-2026-15307: Server-side file-write and request forgery via spatial lookups in Django, 8.8 rating ‍🔥 Recently disclosed Django vulnerability allows an attacker to write a file to disk (in some cases enabling remote code execution) or issue a network request as the Django process user. This flaw is reachable by staff users with view permissions on any registered model containing a spatial field. 👉 https://nt.ls/xa9dB
Post summary
The post announces a newly disclosed Django vulnerability (CVE‑2026‑15307) that permits server‑side file writes or request forgery via spatial lookups, but does not provide PoC, exploit code, active exploitation evidence, or patch information.
04073978
7.7K followersView on X
Repojournal@repojournal45d
Patch
Django patched four critical vulnerabilities across admin and spatial query handling. CVE-2026-15920 tightens URL validation in display_for_field() to prevent malicious admin links. CVE-2026-15307 blocks raster strings and dicts in spatial lookups. CVE-2026-15830 mitigates DoS via nested geometry collections. CVE-2026-15337 hardens check_for_language() against DoS. All four added to the security archive. If you're running Django in production with admin or GIS enabled, patch today. #django https://repojournal.com/showcase/django/2026-08-05/django-patches-four-critical-vulnerabilities-in-admin-and-spatial-queries
Post summary
The post announces Django’s release of patches for four critical admin and GIS-related vulnerabilities, detailing each fix and urging users to update immediately.
0304055
382 followersView on X
Checkmarx Zero@CheckmarxZero30d
Patch
🚨 CVE-2026-15307 (High) affects Django 5.2.x before 5.2.17 and 6.0.x before 6.0.8. GeoDjango passes spatial lookup values to GDALRaster without validation. For example, instead of a legitimate map search area, an attacker can submit a crafted value that enables arbitrary file writes, SSRF, and in some cases remote code execution. Upgrade to 5.2.17 or 6.0.8. More details: https://devhub.checkmarx.com/cve-details/CVE-2026-15307/
Post summary
Advisory announces high‑severity GeoDjango vulnerability allowing arbitrary file writes, SSRF, and possible RCE, and recommends upgrading to Django 5.2.17 or 6.0.8.
0001060
243 followersView on X
しーにゃ♪@公式@Syynya44d
Patch
Django 6.0.8/5.2.17がリリース、ラスター経由のファイル書き込み・SSRF脆弱性(CVE-2026-15307)など4件を修正 https://rocket-boys.co.jp/security-measures-lab/django-release-cve-2026-15307-vulnerability-fixes/
Post summary
Django 6.0.8/5.2.17 have been released, fixing four vulnerabilities including the file write and SSRF issue identified as CVE-2026-15307, with no PoC, exploit code, or active exploitation reported.
1000060
910 followersView on X
CCB Alert@CCBalert44d
Patch
Warning: High severity Server-Side File-Write vulnerability in #Django. #CVE-2026-15307 (CVSS 8.8) can lead to remote code execution #RCE! #Patch #Patch #Patch More info: https://www.djangoproject.com/weblog/2026/aug/04/security-releases/
Post summary
The post alerts that Django CVE‑2026‑15307 is a high‑severity server‑side file‑write flaw leading to remote code execution, and urges users to apply the patch available via Django’s security release page.
01000339
7.2K followersView on X
Xavier Rivera@XavierRiveraX45d
Patch
Three critical patches landed today, one hitting a perfect CVSS 10.0: • HashiCorp Terraform MCP Server: CVE-2026-16498 (10.0), cross-tenant token reuse in stateless mode. Fixed 1.1.0/1.2.0. • Veeam Service Provider Console: CVE-2026-58073 (9.5), unauthenticated credential theft. Fixed build 9.3.0.35057. • Django/GeoDjango: CVE-2026-15307, spatial-lookup file write to RCE. Fixed 6.0.8/5.2.17. No public PoC on any of the three yet. Patch anyway.
Post summary
Three critical patches were released today for Terraform MCP Server, Veeam Service Provider Console, and Django/GeoDjango, including a CVSS 10.0 vulnerability; no public PoC exists yet, and the patch versions are provided.
10000107
596 followersView on X
セキュリティ対策Lab@securityLab_jp44d
Patch
Django 6.0.8/5.2.17がリリース、ラスター経由のファイル書き込み・SSRF脆弱性(CVE-2026-15307)など4件を修正 https://rocket-boys.co.jp/security-measures-lab/django-release-cve-2026-15307-vulnerability-fixes/ #セキュリティ対策Lab #security #securitynews #脆弱性
Post summary
The post announces new Django 6.0.8 and 5.2.17 releases, detailing that they include patches for multiple vulnerabilities, notably CVE‑2026‑15307, and highlighting security improvements.
00000168
513 followersView on X
Upwind Security MDR@UpwindMDR46d
Patch
🚨High - GeoDjango Arbitrary File Write and SSRF Leading to RCE (CVE-2026-15307) Django's GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster via the GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or RasterField reaches it - including untrusted input, e.g. a spatial-field filter in the admin changelist query string from a staff user with view permission. A dict (or its JSON string) is opened in write mode despite write=False, enabling an attacker-controlled file write via a GDAL driver; any other string is treated as a datasource, enabling SSRF through a GDAL virtual filesystem handler. Writing a file to a path the app later imports yields RCE. CVSS 8.7. Only GeoDjango/GIS apps are affected. 👉Upgrade Django to 5.2.17 or 6.0.8.
Post summary
CVE-2026-15307 is a high‑severity GeoDjango flaw permitting arbitrary file writes and SSRF that can lead to remote code execution; upgrading to Django 5.2.17 or 6.0.8 mitigates the issue.
00000122
281 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	djangoproject	django	-	-	-

Explore more

Back to dashboard djangoproject CVEs django vulnerabilities

What researchers are saying

CVE-2026-15307

ThreatWire[verified]@ThreatWire_Disclosure

The tweet announces CVE‑2026‑15307, a high‑severity remote code execution flaw in Django that exploits spatial lookup functionality.

Netlas.io[verified]@Netlas_ioDisclosure

The post announces a newly disclosed Django vulnerability (CVE‑2026‑15307) that permits server‑side file writes or request forgery via spatial lookups, but does not provide PoC, exploit code, active exploitation evidence, or patch information.

Repojournal[verified]@repojournalPatch

The post announces Django’s release of patches for four critical admin and GIS-related vulnerabilities, detailing each fix and urging users to update immediately.

Checkmarx Zero[verified]@CheckmarxZeroPatch

Advisory announces high‑severity GeoDjango vulnerability allowing arbitrary file writes, SSRF, and possible RCE, and recommends upgrading to Django 5.2.17 or 6.0.8.

Xavier Rivera[verified]@XavierRiveraXPatch

Three critical patches were released today for Terraform MCP Server, Veeam Service Provider Console, and Django/GeoDjango, including a CVSS 10.0 vulnerability; no public PoC exists yet, and the patch versions are provided.

セキュリティ対策Lab[verified]@securityLab_jpPatch

The post announces new Django 6.0.8 and 5.2.17 releases, detailing that they include patches for multiple vulnerabilities, notably CVE‑2026‑15307, and highlighting security improvements.

Upwind Security MDR[verified]@UpwindMDRPatch

CVE-2026-15307 is a high‑severity GeoDjango flaw permitting arbitrary file writes and SSRF that can lead to remote code execution; upgrading to Django 5.2.17 or 6.0.8 mitigates the issue.

The Hacker News@TheHackersNewsPatch

The notice announces that Veeam, HashiCorp (Terraform MCP), and Django have released patches for several critical CVEs, detailing the nature of each vulnerability and providing a link for further information.