CVE-2026-87890

Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18 contain an incomplete fix for CVE-2026-15307, a server-side request forgery (SSRF) issue in spatial (GeoDjango) lookups. An attacker who can supply `bytes` values to a spatial lookup — for example, an application that passes user-controlled geometry or raster data into a GeoDjango query — can embed a crafted VRT document referencing an external raster source, causing the Django process to make outbound network requests to a host of the attacker's choosing. The attacker gains the ability to probe or interact with internal network resources from the server's perspective, though with low impact on confidentiality per the CVSS 4.0 rating of 6.9. Applications that never feed user-supplied bytes into spatial lookups are not exposed, and earlier unsupported series (5.1.x, 5.0.x, 4.2.x) were not evaluated and may also be vulnerable. No public proof of concept is known, the issue is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Upgrade to Django 6.1.2, 6.0.9, or 5.2.18 depending on your branch; if you are on an unsupported series (5.1.x, 5.0.x, 4.2.x), move to a supported release since those series were not evaluated and may be affected. Audit code for spatial lookups that accept user-supplied bytes (geometry/raster input) and reject or sanitize VRT content there. Consider egress filtering on application servers so the Django process cannot reach internal services, and review logs for unexpected outbound requests from the application host.