Django GeoDjango EUVD-2026-116020

Exploitation requires that the target application uses GeoDjango (django.contrib.gis) with the GDAL backend AND passes attacker-controlled GeoJSON into django.contrib.gis.gdal.OGRGeometry - for example via a gis forms GeometryField/widget deserialize path. The concrete trigger, per the fix, is a GeoJSON 'crs' member whose type begins with 'link' or 'url', or a CRS 'name' that is not an allowlisted AUTHORITY:CODE (e.g. EPSG:4326), OGC CRS URN, or bare shorthand (CRS84/CRS27/CRS83/WGS84); such external references make GDAL perform I/O to the specified destination. Limiting factors: the vulnerable code path is only present when the GIS/GDAL feature set is installed and the application accepts GeoJSON geometry input, which excludes the large majority of Django deployments that do not use GeoDjango. No authentication or user interaction is required by the CVSS vector where the endpoint is exposed.

This is a medium-severity SSRF (CWE-918) with a nuanced real-world risk profile. The only severity signal in the input is the vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N, score 6.9), which describes a network-reachable, low-complexity, unauthenticated flaw with low confidentiality impact on the vulnerable system and low subsequent-system integrity impact - consistent with an attacker coercing the server into outbound requests. No EPSS score, no CISA KEV entry, and no PoC/exploit reference are present in the input, so there is no public exploit identified at time of analysis and no signal of active or widespread exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a patch-this-cycle priority rather than a drop-everything emergency. The critical mitigating factor the raw CVSS does not capture is scope: the flaw lives in django.contrib.gis.gdal (GeoDjango) and triggers only when an application processes attacker-controlled GeoJSON through OGRGeometry - a feature used by a small minority of Django deployments. So while CVSS marks it network/unauthenticated, real exposure is gated by whether the GIS stack is in use; verify that your application accepts GeoJSON geometry input before treating this as reachable.

A remote attacker submits a crafted GeoJSON geometry (for example to a GeoDjango GeometryField form or any endpoint that feeds user input into OGRGeometry) containing a 'crs' member of type 'link'/'url' or a CRS name that resolves to an external location. When Django hands this to GDAL's OGRSpatialReference, GDAL fetches the attacker-selected destination, producing a server-side request to internal or attacker-chosen hosts. No public exploit is identified in the provided data, but the fix commits reveal the trigger precisely: URL-based or non-allowlisted CRS definitions.