django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

django: Django: Remote code execution via GeoDjango spatial lookups

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.7 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

TencentOS Server 4: python-django (TSSA-2026:0823)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0823 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Python Library Django 5.2.x < 5.2.17 / 6.0.x < 6.0.8 Multiple Vulnerabilities

The detected version of the Django Python package is 5.2.x prior to 5.2.17 or 6.0.x prior to 6.0.8. It is, therefore, affected by multiple vulnerabilities, including: - GeoDjango spatial lookups pass untrusted input to the GDALRaster constructor, allowing an attacker to write arbitrary files via ...

SUSE CVE-2026-15307

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

SUSE CVE-2026-15830

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...

Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug

HashiCorp, Veeam, and the Django Software Foundation have patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django. The three most serious: An unauthenticated flaw in Veeam's console that hands over a managed agent's credentials, rated 9.5 A cross-tenant...

CVE-2026-15830

A flaw was found in Django's GeoDjango component. A remote attacker could exploit this vulnerability by supplying specially crafted, deeply nested geometry collection objects in well-known text WKT, well-known binary WKB, or hex-encoded WKB formats. This triggers unbounded recursion and a...

CVE-2026-15307

A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally,...

CVE-2026-15830

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...

UBUNTU-CVE-2026-15307

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

UBUNTU-CVE-2026-15830

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...

CVE-2026-15830

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...

CVE-2026-15830 Potential denial-of-service vulnerability via nested geometry collections

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...

CVE-2026-15830 Potential denial-of-service vulnerability via nested geometry collections

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...

CVE-2026-15307 Server-side file-write and request forgery via spatial lookups

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

CVE-2026-15307

CVE-2026-15307 affects Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups cast the right-hand side of a filter to a GDALRaster, and any value (including untrusted input) is opened for writing or treated as a datasource, enabling a file to be written with an attacker-chosen n...

Linux Distros Unpatched Vulnerability : CVE-2026-15307

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster b...