Anmelden
Deutsch English Español Polski
Hoch

Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing

  • Veröffentlicht: 04.08.2026
  • Aktualisiert: 11.10.2026 15:18

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or RasterField reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A dict, or a str holding its JSON representation, is opened in write mode regardless of the constructor's write=False default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other str is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

PlattformPaketAnfällige VersionenBehoben in
Python (PyPI) django < 5.2.17, >= 6.0a1, < 6.0.8 5.2.17, 6.0.8

Verweise

CVSS-Wert 8.8/10
CVSS-Vektor
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Schwäche (CWE)
CWE-73
Plattform
Python (PyPI)
Paket
django
Veröffentlicht
04.08.2026
Aktualisiert
11.10.2026 15:18

Quellen und Lizenzen

OSV / GitHub Advisory Database - GHSA-wvqv-fj8w-qmhm - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2026-4035 - PyPA Advisory Database; CC BY 4.0

Schwachstellenhistorie: django

Alle veröffentlichten Schwachstellen dieses Pakets (Python (PyPI)), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (162) im Archiv
Einträge insgesamt
162
Erste → letzte
10.2007 08.2026
Ohne Fix
1
In Angriffen ausgenutzt
0

Verteilung nach Schweregrad

  • Kritisch 16
  • Hoch 65
  • Mittel 63
  • Niedrig 18

Veröffentlichungen pro Jahr

früher: 56

Schweregrad:
  1. Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing dieser Eintrag
    Hoch · 8.8 CVE-2026-15307 < 5.2.17, >= 6.0a1, < 6.0.8 5.2.17, 6.0.8
  2. Django vulnerable to ASGI header spoofing via underscore/hyphen conflation
    Hoch · 7.5 CVE-2026-3902 >= 6.0, < 6.0.4, >= 5.2, < 5.2.13, >= 4.2, < 4.2.30 6.0.4, 5.2.13, 4.2.30
  3. Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit
    Hoch · 7.5 CVE-2026-33034 >= 6.0, < 6.0.4, >= 5.2, < 5.2.13, >= 4.2, < 4.2.30 6.0.4, 5.2.13, 4.2.30
  4. Django vulnerable to Uncontrolled Resource Consumption
    Hoch · 7.5 CVE-2026-25673 >= 6.0, < 6.0.3, >= 5.2, < 5.2.12, >= 4.2, < 4.2.29 6.0.3, 5.2.12, 4.2.29
  5. Django has an SQL Injection issue
    Hoch CVE-2026-1287 >= 6.0a1, < 6.0.2, >= 5.2a1, < 5.2.11, >= 4.2a1, < 4.2.28 6.0.2, 5.2.11, 4.2.28
  6. Django has an SQL Injection issue
    Hoch CVE-2026-1207 >= 6.0a1, < 6.0.2, >= 5.2a1, < 5.2.11, >= 4.2a1, < 4.2.28 6.0.2, 5.2.11, 4.2.28
  7. An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
    Kritisch · 9.1 CVE-2025-64459 >= 4.2, < 4.2.26, >= 5.1, < 5.1.14, >= 5.2, < 5.2.8 4.2.26, 5.1.14, 5.2.8
  8. Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
    Hoch · 7.5 CVE-2025-64458 >= 5.2a1, < 5.2.8, >= 5.0a1, < 5.1.14, < 4.2.26 5.2.8, 5.1.14, 4.2.26
  9. Django vulnerable to SQL injection in column aliases
    Hoch · 7.1 CVE-2025-59681 >= 4.2, < 4.2.25, >= 5.1, < 5.1.13, >= 5.2, < 5.2.7 4.2.25, 5.1.13, 5.2.7
  10. Django is subject to SQL injection through its column aliases
    Hoch · 7.1 CVE-2025-57833 < 4.2.24, >= 5.0a1, < 5.1.12, >= 5.2a1, < 5.2.6 4.2.24, 5.1.12, 5.2.6
  11. Django SQL injection in HasKey(lhs, rhs) on Oracle
    Hoch · 9.8 CVE-2024-53908 >= 5.0.0, < 5.0.10, >= 5.1.0, < 5.1.4, >= 4.2.0, < 4.2.17, >= 5.1, < 5.1.4, >= 5.0, < 5.0.10, >= 4.2, < 4.2.17 5.0.10, 5.1.4, 4.2.17
  12. An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a cr
    Kritisch · 9.1 CVE-2024-42005 >= 5.0, < 5.0.8, >= 4.2, < 4.2.15 5.0.8, 4.2.15
  13. Django vulnerable to Denial of Service
    Hoch · 7.5 CVE-2024-39614 >= 5.0, < 5.0.7, >= 4.2, < 4.2.14 5.0.7, 4.2.14
  14. Django Path Traversal vulnerability
    Hoch · 7.5 CVE-2024-39330 >= 5.0, < 5.0.7, >= 4.2, < 4.2.14 5.0.7, 4.2.14
  15. Django vulnerable to Denial of Service
    Hoch · 7.5 CVE-2024-38875 >= 4.2, < 4.2.14, >= 5.0, < 5.0.7 4.2.14, 5.0.7
  16. Django denial-of-service attack in the intcomma template filter
    Hoch · 5.9 CVE-2024-24680 >= 3.2, < 3.2.24, >= 4.2, < 4.2.10, >= 5.0, < 5.0.2 3.2.24, 4.2.10, 5.0.2
  17. In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of s
    Hoch · 5.9 CVE-2023-43665 >= 3.2, < 3.2.22, >= 4.1, < 4.1.12, >= 4.2, < 4.2.6 3.2.22, 4.1.12, 4.2.6
  18. An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is su
    Hoch · 7.5 CVE-2023-46695 >= 3.2, < 3.2.23, >= 4.1, < 4.1.13, >= 4.2, < 4.2.7 3.2.23, 4.1.13, 4.2.7
  19. In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large numb
    Hoch · 7.5 CVE-2023-36053 >= 4.2, < 4.2.3, >= 4.0, < 4.1.10, >= 3.2, < 3.2.20 4.2.3, 4.1.10, 3.2.20
  20. In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been suppor
    Kritisch · 9.8 CVE-2023-31047 >= 3.2, < 3.2.19, >= 4.0, < 4.1.9, >= 4.2, < 4.2.1 3.2.19, 4.1.9, 4.2.1
  21. An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart f
    Hoch · 7.5 CVE-2023-24580 >= 3.2, < 3.2.18, >= 4.0, < 4.0.10, >= 4.1, < 4.1.7 3.2.18, 4.0.10, 4.1.7
  22. In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-s
    Hoch · 7.5 CVE-2023-23969 >= 3.2, < 3.2.17, >= 4.0, < 4.0.9, >= 4.1, < 4.1.6 3.2.17, 4.0.9, 4.1.6
  23. In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular
    Hoch · 7.5 CVE-2022-41323 >= 3.2, < 3.2.16, >= 4.0, < 4.0.8, >= 4.1, < 4.1.2 3.2.16, 4.0.8, 4.1.2
  24. Django vulnerable to Reflected File Download attack
    Hoch · 8.8 CVE-2022-36359 < 3.2.15, >= 4.0, < 4.0.7 3.2.15, 4.0.7
  25. Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection
    Kritisch · 9.8 CVE-2022-34265 >= 3.2a1, < 3.2.14, >= 4.0a1, < 4.0.6 3.2.14, 4.0.6
  26. Django Arbitrary Code Execution
    Hoch CVE-2007-0404 >= 0.95, < 1.0 1.0
  27. SQL Injection in Django
    Kritisch · 9.8 CVE-2022-28347 >= 2.2, < 2.2.28, >= 3.2, < 3.2.13, >= 4.0, < 4.0.4 2.2.28, 3.2.13, 4.0.4
  28. SQL Injection in Django
    Kritisch · 9.8 CVE-2022-28346 >= 2.2, < 2.2.28, >= 3.2, < 3.2.13, >= 4.0, < 4.0.4 2.2.28, 3.2.13, 4.0.4
  29. Infinite Loop in Django
    Hoch · 7.5 CVE-2022-23833 >= 2.2, < 2.2.27, >= 3.2, < 3.2.12, >= 4.0, < 4.0.2 2.2.27, 3.2.12, 4.0.2
  30. Information disclosure in Django
    Hoch · 7.5 CVE-2021-45116 >= 2.2, < 2.2.26, >= 3.2, < 3.2.11, >= 4.0, < 4.0.1 2.2.26, 3.2.11, 4.0.1
  31. Denial-of-service in Django
    Hoch · 7.5 CVE-2021-45115 >= 2.2a1, < 2.2.26, >= 3.2a1, < 3.2.11, >= 4.0a1, < 4.0.1 2.2.26, 3.2.11, 4.0.1
  32. SQL Injection in Django
    Kritisch · 9.8 CVE-2021-35042 >= 3.2a1, < 3.2.5, >= 3.0a1, < 3.1.13 3.2.5, 3.1.13
  33. Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks
    Hoch · 7.5 CVE-2021-33571 >= 2.2a1, < 2.2.24, >= 3.0a1, < 3.1.12, >= 3.2a1, < 3.2.4 2.2.24, 3.1.12, 3.2.4
  34. Path Traversal in Django
    Hoch · 7.5 CVE-2021-31542 >= 2.2, < 2.2.21, >= 3.0, < 3.1.9, >= 3.2, < 3.2.1 2.2.21, 3.1.9, 3.2.1
  35. Django Incorrect Default Permissions
    Hoch · 7.5 CVE-2020-24583 >= 2.2a1, < 2.2.16, >= 3.0a1, < 3.0.10, >= 3.1a1, < 3.1.1 2.2.16, 3.0.10, 3.1.1
  36. Data leakage via cache key collision in Django
    Hoch · 5.9 CVE-2020-13254 >= 2.2, < 2.2.13, >= 3.0, < 3.0.7 2.2.13, 3.0.7
  37. Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suit
    Hoch · 8.8 CVE-2020-9402 >= 1.11, < 1.11.29, >= 2.2, < 2.2.11, >= 3.0, < 3.0.4 1.11.29, 2.2.11, 3.0.4
  38. SQL injection in Django
    Kritisch · 9.8 CVE-2020-7471 < 1.11.28, >= 2.0, < 2.2.10, >= 3.0, < 3.0.3 1.11.28, 2.2.10, 3.0.3
  39. Django Potential account hijack via password reset form
    Kritisch · 9.8 CVE-2019-19844 < 1.11.27, >= 2.0, < 2.2.9, >= 3.0, < 3.0.1 1.11.27, 2.2.9, 3.0.1
  40. Django allows unintended model editing
    Hoch · 6.5 CVE-2019-19118 >= 2.1, < 2.1.15, >= 2.2, < 2.2.8 2.1.15, 2.2.8
  41. SQL Injection in Django
    Kritisch · 9.8 CVE-2019-14234 >= 1.11a1, < 1.11.23, >= 2.1a1, < 2.1.11, >= 2.2a1, < 2.2.4 1.11.23, 2.1.11, 2.2.4
  42. Uncontrolled Recursion in Django
    Hoch · 7.5 CVE-2019-14235 >= 1.11a1, < 1.11.23, >= 2.1a1, < 2.1.11, >= 2.2a1, < 2.2.4 1.11.23, 2.1.11, 2.2.4
  43. Django Denial-of-service in strip_tags()
    Hoch · 7.5 CVE-2019-14233 >= 1.11a1, < 1.11.23, >= 2.1a1, < 2.1.11, >= 2.2a1, < 2.2.4 1.11.23, 2.1.11, 2.2.4
  44. Django Denial-of-service in django.utils.text.Truncator
    Hoch · 7.5 CVE-2019-14232 >= 1.11a1, < 1.11.23, >= 2.1a1, < 2.1.11, >= 2.2a1, < 2.2.4 1.11.23, 2.1.11, 2.2.4
  45. Uncontrolled Memory Consumption in Django
    Hoch · 7.5 CVE-2019-6975 >= 1.11, < 1.11.19, >= 2.0, < 2.0.11, >= 2.1, < 2.1.6 1.11.19, 2.0.11, 2.1.6
  46. Improper Input Validation in Django
    Hoch · 6.5 CVE-2019-3498 >= 1.11a1, < 1.11.18, >= 2.0a1, < 2.0.10, >= 2.1a1, < 2.1.5 1.11.18, 2.0.10, 2.1.5
  47. Django vulnerable to information leakage in AuthenticationForm
    Hoch · 7.5 CVE-2018-6188 >= 2.0a1, < 2.0.2, >= 1.11.8, < 1.11.10 2.0.2, 1.11.10
  48. Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate
    Kritisch · 8.1 CVE-2016-9014 < 1.8.16, >= 1.9, < 1.9.11, >= 1.10, < 1.10.3 1.8.16, 1.9.11, 1.10.3
  49. Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easi
    Kritisch · 9.8 CVE-2016-9013 >= 1.8, < 1.8.16, >= 1.9, < 1.9.11, >= 1.10, < 1.10.3 1.8.16, 1.9.11, 1.10.3
  50. The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting a
    Hoch · 7.5 CVE-2016-7401 < 1.8.15, >= 1.9, < 1.9.10 1.8.15, 1.9.10
  51. Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option w
    Hoch · 5.5 CVE-2016-2048 >= 1.9, < 1.9.2 1.9.2
  52. Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP r
    Hoch · 7.5 CVE-2015-5144 < 1.4.21, >= 1.5, < 1.7.9, >= 1.8, < 1.8.3 1.4.21, 1.7.9, 1.8.3
  53. validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
    Hoch · 7.5 CVE-2015-5145 >= 1.8, < 1.8.3 1.8.3
  54. Django Denial-of-service by filling session store
    Hoch · 7.5 CVE-2015-5143 < 1.4.21, >= 1.5, < 1.7.9, >= 1.8, < 1.8.3 1.4.21, 1.7.9, 1.8.3
  55. The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of servic
    Hoch · 7.5 CVE-2015-2316 >= 1.6, < 1.6.11, >= 1.7, < 1.7.7, >= 1.8a0, < 1.8c1 1.6.11, 1.7.7, 1.8c1
  56. The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service
    Hoch · 7.5 CVE-2015-0221 < 1.4.18, >= 1.5, < 1.6.10, >= 1.7, < 1.7.3 1.4.18, 1.6.10, 1.7.3
  57. ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate val
    Hoch · 7.5 CVE-2015-0222 < 1.4.18, >= 1.5, < 1.6.10, >= 1.7, < 1.7.3 1.4.18, 1.6.10, 1.7.3
  58. The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation
    Hoch · 7.5 CVE-2014-0481 < 1.4.14, >= 1.5, < 1.5.9, >= 1.6, < 1.6.6 1.4.14, 1.5.9, 1.6.6
  59. The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attacker
    Hoch · 7.5 CVE-2014-0480 < 1.4.14, >= 1.5, < 1.5.9, >= 1.6, < 1.6.6 1.4.14, 1.5.9, 1.6.6
  60. The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduc
    Hoch · 7.5 CVE-2014-3730 >= 1.4, < 1.4.13, >= 1.5, < 1.5.8, >= 1.6, < 1.6.5, >= 1.7a0, < 1.7b4 1.4.13, 1.5.8, 1.6.5, 1.7b4
Mehr anzeigen (20) 60 von 81 angezeigt

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden
DockRay Newsletter

Anwendungssicherheit in Ihrem Postfach

Wichtige Schwachstellen, konkrete Empfehlungen und praktische Tipps für Ihre Anwendungen. Wählen Sie Ihre Technologien und verfolgen Sie, was für Ihr Projekt relevant ist.

  • Eine tägliche Zusammenfassung neuer Schwachstellen, auch kritischer.
  • Benachrichtigungen über wichtige Updates.
  • Praktische Tipps zur Sicherheit und Überwachung von Anwendungen.

Leer lassen, um Meldungen zu allen Technologien zu erhalten.

Datenschutzerklärung

Kostenlos anmelden. In jeder E-Mail mit einem Klick abmelden.