PT-2026-106734
CVE-2026-87890
·
Published
2026-10-06
·
Updated
2026-10-28
Description by
CVSS 4.0
6.9
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Django versions prior to 6.1.2
Django versions prior to 6.0.9
Django versions prior to 5.2.18
Description
An incomplete fix in spatial lookups allows an attacker to trigger network requests by providing
bytes values. This occurs through a crafted VRT (Virtual Raster Table) document that references an external raster source, causing the Django process to initiate the request.Recommendations
Update to version 6.1.2 or later.
Update to version 6.0.9 or later.
Update to version 5.2.18 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾