CVE-2026-87890
Django: Potential request forgery via spatial lookup byte values
djangoproject DjangoFrameworksCVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply bytes values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank sicksec for reporting this issue.
Text from CVE List
Affected versions 6
- Djangoaffected: 6.1 before 6.1.2CVE List
- Djangounaffected: 6.1.2CVE List
- Djangoaffected: 6.0 before 6.0.9CVE List
- Djangounaffected: 6.0.9CVE List
- Djangoaffected: 5.2 before 5.2.18CVE List
- Djangounaffected: 5.2.18CVE List
References 7
- github.com/django/django/commit/ebcb13b327301f28cbc6cd5e4988a719f00575aaFixvia CVE List
- github.com/django/django/commit/4e77ef1e69c94780006b82795aa7db101996c3afFixvia CVE List
- github.com/django/django/commit/a2347fe8234a1831d56c875acc0ea51e0742957cFixvia CVE List
- github.com/django/django/commit/dd0558d1617619e0d66163675ef02135d0f54e5fFixvia CVE List
- docs.djangoproject.com/en/dev/releases/security/Advisoryvia CVE List
- djangoproject.com/weblog/2026/oct/06/security-releases/Advisoryvia CVE List
- groups.google.com/g/django-announceReferencevia CVE List