Live › vulnerability › CVE-2026-114582
Django's GIS spatial reference parser passes string input to GDAL without restricting file and network access. An attacker who supplies a crafted spatial reference string can make the server fetch URLs or read local files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Only applications that use Django's GIS module (django.contrib.gis) and pass user-controlled strings into spatial reference handling or transform calls are exposed. Sites that do not use GeoDjango, or that only handle trusted spatial data, can skip it. Earlier unsupported series (5.1, 5.0, 4.2) were not evaluated and may also be affected.
No product ranges from the sources yet.
python -m django --version.django.contrib.gis with SpatialReference, transform(), or srs/srid settings that take user-supplied input.6.1.3 for the 6.1 series6.0.10 for the 6.0 series5.2.19 for the 5.2 seriesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
django.contrib.gis.gdal.SpatialReference (and related transform() methods and srs/srid setters) do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger server-side requests or local file reads via crafted spatial reference strings.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Adraca for reporting this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-114582")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.