CVE-2026-114582

Name of the Vulnerable Software and Affected Versions Django versions prior to 6.1.3 Django versions prior to 6.0.10 Django versions prior to 5.2.19

Description django.contrib.gis.gdal.SpatialReference and its associated transform() methods and srs/srid setters fail to restrict GDAL file and network access during string input parsing. This allows attackers to initiate server-side requests or read local files by providing specially crafted spatial reference strings.

Recommendations Update to version 6.1.3 or later. Update to version 6.0.10 or later. Update to version 5.2.19 or later.