Django releases security updates for six CVEs
Django security releases address multiple vulnerabilities including CVE-2026-108147, CVE-2026-111211, CVE-2026-111362, CVE-2026-113593, CVE-2026-113733, and CVE-2026-114582.
40
CVE-2026-114582
GDAL access in Django GIS SpatialReference before 6.1.3
- CVSS 4.0
- 6.9 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Django's django.contrib.gis.gdal.SpatialReference does not restrict GDAL file or network access when parsing spatial reference strings. Attackers can trigger server-side requests or local file reads with crafted input. This affects Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. Earlier unsupported series may also be vulnerable.
What to do: Upgrade to Django 6.1.3, 6.0.10, or 5.2.19.
| Product | Affected | Fixed in |
|---|---|---|
| Django | 6.1 < 6.1.3, 6.0 < 6.0.10, 5.2 < 5.2.19 | 6.1.3, 6.0.10, 5.2.19 |
| Django | 5.1.x, 5.0.x, 4.2.x | — |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.gdal.SpatialReference` (and related `transform()` methods and `srs`/`srid` setters) do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger server-side requests or local file reads via crafted spatial reference strings. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Adraca for reporting this issue.
- Weakness
- CWE-918
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X