Server-side file-write and request forgery via spatial lookups in Django (CVE-2026-15307)

Django's spatial lookups allowed `str` and `dict` lookup values to be passed to `GDALRaster` when they represented rasters. Depending on the raster driver, this could write a file to disk (in some cases enabling remote code execution) or issue a network request as the Django process user. The flaw was reachable by staff users with view permissions on any registered model containing a spatial field via the admin changelist. Affected versions: - Django main - Django 6.1 (currently at release candidate status) - Django 6.0 - Django 5.2 We recommend updating to: Django 6.0.8, Django 5.2.17. CVSS ? · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/406 Details: https://vuln.today/cve/CVE-2026-15307