`django.contrib.gis.gdal.SpatialReference` and its associated `transform()` methods and `srs`/`srid` setters fail to restrict GDAL file and network access during string input parsing. This allows attackers to initiate server-side requests or read local files by providing specially crafted spatial reference strings.