DEBIAN-CVE-2026-114582
Dashboard / Vulnerabilities / DEBIAN-CVE-2026-114582
Summary:
Details: An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.gdal.SpatialReference` (and related `transform()` methods and `srs`/`srid` setters) do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger server-side requests or local file reads via crafted spatial reference strings. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Adraca for reporting this issue.
Affected packages
Package
Name: python-django
Purl: pkg:deb/debian/python-django?arch=source&distro=bookworm
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -None
Affected versions
3:3.2.19-1
3:3.2.19-1+deb12u1
3:3.2.19-1+deb12u1~bpo11+1
3:3.2.19-1+deb12u2
3:3.2.20-1
3:3.2.20-1.1
3:3.2.21-1
3:3.2.25-0+deb12u1
3:3.2.25-0+deb12u2
3:3.2.25-0+deb12u3
3:3.2.25-0+deb12u4
3:3.2.25-0+deb12u5
3:3.2.25-0+deb12u6
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
