DEBIAN-CVE-2026-111211
Dashboard / Vulnerabilities / DEBIAN-CVE-2026-111211
Summary:
Details: An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Aaron chen for reporting this issue.
Affected packages
Package
Name: python-django
Purl: pkg:deb/debian/python-django?arch=source&distro=bookworm
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -None
Affected versions
3:3.2.19-1
3:3.2.19-1+deb12u1
3:3.2.19-1+deb12u1~bpo11+1
3:3.2.19-1+deb12u2
3:3.2.20-1
3:3.2.20-1.1
3:3.2.21-1
3:3.2.25-0+deb12u1
3:3.2.25-0+deb12u2
3:3.2.25-0+deb12u3
3:3.2.25-0+deb12u4
3:3.2.25-0+deb12u5
3:3.2.25-0+deb12u6
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
