CVE-2026-15307

Name of the Vulnerable Software and Affected Versions Django versions 5.2 through 5.2.16 Django versions 6.0 through 6.0.7

Description GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. This process allows untrusted input, such as spatial-field filters submitted via the Django admin changelist query string by staff users with view permissions, to reach the constructor. If a dict or a str containing its JSON representation is provided, it is opened in write mode, enabling an attacker to write a file with a chosen name and content through a file-backed GDAL driver. Other str values are treated as datasources, which can trigger outbound network requests via a GDAL virtual filesystem handler. Writing files to locations subsequently imported by the application may lead to remote code execution.

Recommendations Update Django versions 5.2 through 5.2.16 to version 5.2.17. Update Django versions 6.0 through 6.0.7 to version 6.0.8.