EUVD-2026-23787
GHSA-hq9j-qh3w-qvg3
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was found in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of the component File Upload Endpoint. Performing a manipulation of the argument SECRET_KEY results in use of hard-coded cryptographic key . Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
DjangoBlog versions up to 2.1.0.0 use a hard-coded cryptographic key in djangoblog/settings.py when the SECRET_KEY argument is manipulated during file upload operations, allowing remote attackers with user interaction to obtain sensitive information. The attack requires high complexity and user participation, resulting in a low confidentiality impact (CVSS 2.3). Publicly available exploit code exists, though the vendor has not responded to disclosure attempts.
Technical ContextAI
The vulnerability involves CWE-321 (Use of Hard-coded Cryptographic Key), a root cause in Django web applications where cryptographic operations rely on static, predictable secrets rather than securely generated and stored keys. DjangoBlog is a Python-based blogging platform built on the Django framework; the file upload endpoint in djangoblog/settings.py processes user-supplied file uploads and derives cryptographic operations (likely for integrity checks, session tokens, or CSRF protection) from the SECRET_KEY parameter. When an attacker manipulates the SECRET_KEY argument during a file upload request, the application falls back to or reveals a hard-coded cryptographic key, weakening cryptographic protections. This is compounded by Django's reliance on SECRET_KEY for CSRF tokens, session serialization, and password reset tokens - exposure or predictability of this key compromises authentication and authorization mechanisms.
RemediationAI
No vendor-released patch was identified at time of analysis due to the vendor's lack of response to early disclosure. To remediate, upgrade DjangoBlog to a version newer than 2.1.0.0 if available; check the liangliangyy/DjangoBlog GitHub repository for post-2.1.0.0 releases. As an immediate compensating control, disable file upload functionality or restrict file uploads to authenticated users only and implement strict allowlist-based validation of uploaded file types and sizes. Additionally, ensure the Django application uses a cryptographically secure, non-hardcoded SECRET_KEY generated at deployment time and stored securely in environment variables or a secrets management system - do not commit SECRET_KEY to version control. This workaround mitigates the hard-coded key exposure but does not fully prevent SECRET_KEY manipulation unless the application also validates and rejects suspicious SECRET_KEY modifications during request handling. Monitor DjangoBlog release notes and GitHub issues for upstream patches; if no update is forthcoming and file upload is business-critical, consider migrating to an actively maintained blogging platform.
More in Djangoblog
View allDjangoBlog up to version 2.1.0.0 contains an authentication bypass vulnerability in the blog/views.py Clean Endpoint tha
Missing authentication in DjangoBlog 2.1.0.0 and prior allows remote unauthenticated attackers to inject GPS tracking da
Hard-coded Amap API key exposure in DjangoBlog allows remote attackers to abuse geolocation services without authenticat
Cross-site Scripting (XSS) - Stored in GitHub repository liangliangyy/djangoblog prior to master. Rated medium severity
DjangoBlog up to version 2.1.0.0 contains hard-coded credentials in djangoblog/settings.py that can be exploited remotel
Liangliangyy DjangoBlog up to version 2.1.0.0 contains hard-coded credentials in the SECRET_KEY parameter within djangob
Command injection in DjangoBlog WeChat Bot Interface allows authenticated remote attackers to execute arbitrary system c
Improper authorization in liangliangyy DjangoBlog versions up to 2.1.0.0 allows authenticated remote attackers to manipu
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today