MEDIUM 6.9 NVD
CVE-2026-114582
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.gdal.SpatialReference` (and related `transform
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
`django.contrib.gis.gdal.SpatialReference` (and related `transform()` methods and `srs`/`srid` setters) do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger server-side requests or local file reads via crafted spatial reference strings.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Adraca for reporting this issue.
References
- https://docs.djangoproject.com/en/dev/releases/security/
- https://github.com/django/django/commit/1c980729e53ef119d43a01d32ead30116c46cd36
- https://github.com/django/django/commit/3a2ec4378b53c7b8ff5283ad7eba624ffa6f2b2f
- https://github.com/django/django/commit/8bda4d0db15f28828d8db000287562efae5ce063
- https://github.com/django/django/commit/a658355eb51feccbe90b5ca2e3b7f3543cd99e01
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-11-03 via NVD.
vulnfeed aggregates 18261 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.