onyx --cves cve-2026-15307
CVE-2026-15307
- score
- 0.2
- cvss
- 8.8
- epss
- 1.1%
- published
- 2026-08-04
- kev added
- —
- first seen
Django 5.2 < 5.2.17 and 6.0 < 6.0.8 contain a remote code execution vulnerability caused by unsafe parsing of spatial lookup inputs in GeoDjango's GDALRaster constructor, letting staff users with view permission write files or trigger network requests, exploit requires staff user with view permission.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- First advisory — Django weblog Django security releases issued: 6.1.2, 6.0.9, and 5.2.18
- Tracked by Onyx
Advisories
0 feeds this week
Weaknesses
References 7
- https://docs.djangoproject.com/en/dev/releases/security/
- https://github.com/django/django/commit/115ffd0463a765ab1cc93de18e94b5459b8a300e
- https://github.com/django/django/commit/208f80cb682868b584ed0a78f23e4ba6304212aa
- https://github.com/django/django/commit/39b3e2d0c743a338def6c473086ebc06865e86b6
- https://github.com/django/django/commit/f1949c1f9758947ade984c895ff16bef46f56520
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2026/aug/04/security-releases/