CVE-2026-1207

Name of the Vulnerable Software and Affected Versions Django versions prior to 6.0.2 Django versions prior to 5.2.11 Django versions prior to 4.2.28

Description A flaw in the GeoDjango RasterField implementation, specifically when using a PostGIS backend, allows remote attackers to perform SQL injection. The issue occurs because the software fails to properly parameterize the band index during raster lookup processing, allowing user-supplied input to be concatenated directly into SQL queries. This can lead to unauthorized information disclosure, data alteration, denial of service, or potential remote code execution on database hosts. Real-world incidents indicate that this issue has been actively exploited in targeted attacks against mapping platforms, location services, and geospatial analytics applications. The vulnerability is triggered via the band index parameter during raster lookups.

Recommendations Update Django to version 6.0.2. Update Django to version 5.2.11. Update Django to version 4.2.28. Restrict access to raster endpoints to minimize the risk of exploitation. Enforce strict input validation on the band index parameter. Deploy WAF rules to filter common SQL injection patterns.