CVE-2026-1207

EUVD-2026-5253
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Tarek Nakkouch for reporting this issue.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CISA-ADPADP
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 87%
Affected Products (NVD)
VendorProductVersion
djangoprojectdjango
4.2 ≤
𝑥
< 4.2.28
djangoprojectdjango
5.2 ≤
𝑥
< 5.2.11
djangoprojectdjango
6.0 ≤
𝑥
< 6.0.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
python-django
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
2:2.2.28-1~deb11u12
fixed
forky
3:4.2.28-1
fixed
sid
3:4.2.28-1
fixed
trixie
vulnerable
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-django
bionic
Fixed 1:1.11.11-1ubuntu1.21+esm14
released
focal
Fixed 2:2.2.12-1ubuntu0.29+esm7
released
jammy
Fixed 2:3.2.12-2ubuntu1.25
released
noble
Fixed 3:4.2.11-1ubuntu1.14
released
questing
Fixed 3:5.2.4-1ubuntu2.3
released
trusty
not-affected
xenial
not-affected
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://docs.djangoproject.com/en/dev/releases/security/
https://groups.google.com/g/django-announce
https://www.djangoproject.com/weblog/2026/feb/03/security-releases/