CVE-2026-87890

EUVD-2026-93388

06.10.2026, 14:17

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank sicksec for reporting this issue.

SSRF

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
DSF	CNA	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
djangoproject	django	6.1 ≤ 𝑥 < 6.1.2	CNA
djangoproject	django	6.0 ≤ 𝑥 < 6.0.9	CNA
djangoproject	django	5.2 ≤ 𝑥 < 5.2.18	CNA

Debian Releases

Debian Product

Codename

python-django

bookworm	vulnerable
bookworm (security)	vulnerable
forky	vulnerable
sid	3:5.2.18-1 fixed
trixie	vulnerable
trixie (security)	vulnerable

Common Weakness Enumeration

CWE-918 - Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References

https://docs.djangoproject.com/en/dev/releases/security/

https://github.com/django/django/commit/4e77ef1e69c94780006b82795aa7db101996c3af

https://github.com/django/django/commit/a2347fe8234a1831d56c875acc0ea51e0742957c

https://github.com/django/django/commit/dd0558d1617619e0d66163675ef02135d0f54e5f

https://github.com/django/django/commit/ebcb13b327301f28cbc6cd5e4988a719f00575aa

https://groups.google.com/g/django-announce

https://www.djangoproject.com/weblog/2026/oct/06/security-releases/