VulnSocial

CVE-2026-15920Disclosure(djangoproject / django)

LOWCVSS 5.1 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch djangoproject django systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.

djangoproject CVEsBack to dashboard
2.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-83

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • django

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-08-05); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
djangoproject
Products
django

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-08-05: 2Mentions · 2026-08-07: 1PoC Mentioned / Linked · 2026-08-05: 1Patch / Workaround · 2026-08-05: 1Technical Details · 2026-08-05: 2Technical Details · 2026-08-07: 108-0508-07
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-08-052
Disclosure1Patch1
2026-08-071
Disclosure1
Full discourse3 posts
  • Repojournal@repojournal
    Patch

    Django patched four critical vulnerabilities across admin and spatial query handling. CVE-2026-15920 tightens URL validation in display_for_field() to prevent malicious admin links. CVE-2026-15307 blocks raster strings and dicts in spatial lookups. CVE-2026-15830 mitigates DoS via nested geometry collections. CVE-2026-15337 hardens check_for_language() against DoS. All four added to the security archive. If you're running Django in production with admin or GIS enabled, patch today. #django https://repojournal.com/showcase/django/2026-08-05/django-patches-four-critical-vulnerabilities-in-admin-and-spatial-queries

    Post summary

    The post announces Django's patching of four critical CVEs, details each fix, and urges users to update promptly.

    0304055
    382 followersView on X
  • /r/netsec@_r_netsec
    Disclosure

    Stored XSS in Django's admin via an unvalidated URLField display path (CVE-2026-15920) https://syntetisk.tech/blog/posts/stored-xss-in-djangos-admin-via-an-unvalidated-urlfield-display-path-cve-2026-15920/

    Post summary

    A new stored XSS vulnerability (CVE‑2026‑15920) in Django’s admin has been disclosed, affecting an unvalidated URLField display path, with a linked blog post providing further technical details.

    020221.1K
    33.8K followersView on X
  • CompuChris@compuchris
    Disclosure

    Stored XSS in Django's admin via an unvalidated URLField display path (CVE-2026-15920) #CISO https://www.reddit.com/r/cybersecurity/comments/1vg98d6/stored_xss_in_djangos_admin_via_an_unvalidated/

    Post summary

    A brief Reddit post announces a stored XSS flaw in Django’s admin caused by an unvalidated URLField display path (CVE‑2026‑15920), but provides no PoC, exploit, patch, or evidence of active exploitation.

    0000045
    1.7K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appdjangoprojectdjango---

Explore more

Back to dashboarddjangoproject CVEsdjango vulnerabilities