EUVD-2026-52747
GHSA-wvqv-fj8w-qmhm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Staff authentication required (PR:L); SSRF and file-write can affect resources beyond the Django process boundary (S:C); exploitable over the network via the admin interface (AV:N).
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Server-side file-write and server-side request forgery (SSRF) in Django's GeoDjango spatial lookups expose authenticated staff users as an attack surface capable of writing arbitrary files to disk or issuing outbound network requests as the Django process user. Affected are Django 5.2 (before 5.2.17) and 6.0 (before 6.0.8), where the Django admin changelist's standard filter mechanism made the flaw reachable by any staff account holding view permissions on a model with a spatial field. Depending on the GDAL raster driver available on the server, file writes can escalate to remote code execution. No public exploit is identified at time of analysis; patched releases Django 5.2.17 and 6.0.8 were issued August 4, 2026.
Technical ContextAI
The vulnerability resides in Django's contrib.gis (GeoDjango) module, specifically in how spatial lookup values are processed by the GDALRaster constructor within the ORM's get_db_prep_value method. GDAL (Geospatial Data Abstraction Library) supports a virtual filesystem (VSI) layer that allows drivers to open paths using network protocols (e.g., /vsicurl/ for HTTP, /vsis3/ for S3) or to create new raster files on disk when passed a dict definition. Prior to the fix, the ORM forwarded raw str and dict types - which are valid for model field assignment - directly into spatial lookups without distinguishing that lookup contexts carry different trust semantics. A serialized dict representing a raster definition would cause GDAL to create a new file, while a crafted str containing a VSI path would trigger an outbound network request. The fix introduces a DisallowedRasterLookup exception (subclass of SuspiciousOperation) and a new check_raster_lookup_value() classmethod on GDALRaster that blocks dict and str types in lookup contexts unless the caller explicitly wraps them in GDALRaster(), making the intent to write or fetch explicit. No CWE identifier was provided in the source data; the root cause class is improper input validation - specifically, conflating the semantics of field assignment with ORM lookup evaluation.
RemediationAI
Upgrade to Django 5.2.17 or Django 6.0.8, both released August 4, 2026, which are the vendor-confirmed patched versions. Signed release packages are available at https://www.djangoproject.com/download/5.2.17/tarball/ and corresponding wheel files at https://www.djangoproject.com/download/5.2.17/wheel/; checksums are published at https://www.djangoproject.com/download/5.2.17/checksum/. If immediate upgrade is not possible, the most targeted compensating control is to remove staff users' view permissions on any admin-registered model containing a spatial field, which closes the lookup_allowed() attack path but prevents those users from accessing those model views in the admin. Alternatively, un-register spatial models from the Django admin entirely until patching is complete, at the cost of losing admin visibility into those models. A network-level compensating control - adding strict egress filtering at the firewall to block unexpected outbound connections from the Django application server process - mitigates the SSRF vector but leaves the file-write vector unaddressed. The raster security considerations documentation at https://docs.djangoproject.com/en/dev/ref/contrib/gis/gdal/#raster-security provides guidance on how to continue using str and dict types in spatial lookups after upgrading by wrapping them explicitly in GDALRaster().
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-73 – External Control of File Name or Path
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today