Django has issued security releases 6.0.8 and 5.2.17 addressing four CVEs. CVE-2026-15307 (high severity) allows server-side file writes or request forgery via spatial lookups accepting unsafe str/dict values, potentially enabling remote code execution. CVE-2026-15337 (low severity) is a denial-of-service in check_for_language() via very long language codes, now rejected above 500 characters. CVE-2026-15830 (moderate severity) is a DoS via deeply nested GEOMETRYCOLLECTION objects causing a segfault in GEOS, now limited to 198 collections. CVE-2026-15920 (moderate severity) is a stored XSS via URLField values rendered as links in the admin without URL validation. All users are urged to upgrade immediately.
Table of contents
CVE-2026-15307: Server-side file-write and request forgery via spatial lookupsCVE-2026-15337: Potential denial-of-service vulnerability in check_for_language()CVE-2026-15830: Potential denial-of-service vulnerability via nested geometry collectionsCVE-2026-15920: Potential cross-site scripting via URLField values in the adminAffected supported versionsResolutionThe following releases have been issuedGeneral notes regarding security reporting13.4K Impressions1 Comment