---
id: "CVE-2026-111211"
kind: "vulnerability"
aliases: ["CVE-2026-111211"]
title: "Django: GIS geometry form field lets attackers forge log entries"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["django", "gis", "package", "python", "web"]
not_affected_if: ["no-gis-forms", "older-unsupported-not-evaluated"]
published_at: "2026-11-03T16:17:18+00:00"
first_seen_at: "2026-11-03T16:21:42+00:00"
updated_at: "2026-11-03T16:24:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111211", "first_seen_at": "2026-11-03T16:21:42+00:00"}]
---

# Django: GIS geometry form field lets attackers forge log entries

Django's GIS geometry form widget writes submitted invalid values to logs without escaping them. A remote attacker can send a crafted geometry value to inject or forge log lines.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Django version with `python -m django --version`.
- Look for `django.contrib.gis.forms.GeometryField` or `BaseGeometryWidget` in the project code.

## Fix

- Django `6.1.3` for the 6.1 series
- Django `6.0.10` for the 6.0 series
- Django `5.2.19` for the 5.2 series
- Earlier unsupported series were not evaluated by the sources; their status is unknown.

## Timeline

- 2026-11-03T16:21:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111211

## Documents

- [fix] Patch: github.com https://github.com/django/django/commit/1b747694d6a68a6b5d48cbe81c71053092a5d374
- [fix] Patch: github.com https://github.com/django/django/commit/af4319f7217e33ad5db747226765f09b49ec07ba
- [fix] Patch: github.com https://github.com/django/django/commit/b336d9a4e8a919d2e5f979b663de2b27e245b793
- [fix] Patch: github.com https://github.com/django/django/commit/b83bf870ee0006ab0dd84a01d1f3b0391320a51a

## From the sources

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
`django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Aaron chen for reporting this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_