Django patches high-severity spatial lookup file-write flaw

Django has issued security releases 5.2.17 and 6.0.8 fixing four vulnerabilities, led by a high-severity flaw that let staff users write files to disk or forge network requests through spatial lookups.

CVE-2026-15307 stemmed from spatial lookups accepting string and dictionary values that represented rasters and passing them to GDALRaster. Depending on the raster driver, that could write a file as the Django process user (in some cases enabling remote code execution) or issue a network request. The path was reachable through the admin changelist by any staff user with view permission on a registered model that has a spatial field.

The fix disallows dictionaries and strings that are not valid geometries in spatial lookups, a backward-incompatible change. Assignments to model fields are unaffected. Django rates the issue high and encourages all users to upgrade as soon as possible.

Natalia Bidart announced the releases for the Django team. The other three CVEs addressed in the same releases are CVE-2026-15337, CVE-2026-15830, and CVE-2026-15920.