Django Releases Security Updates 6.0.8 and 5.2.17 to Address Multiple Vulnerabilities

Critical Security Updates Issued

The Django project has released security updates, Django 6.0.8 and 5.2.17, to address several vulnerabilities. These releases are in line with the project's security release policy and users are strongly encouraged to upgrade their installations promptly.

High-Severity File-Write and Request Forgery Vulnerability

One of the critical issues addressed is CVE-2026-15307, rated as 'high' severity. This vulnerability allowed server-side file-write and request forgery through spatial lookups. Specifically, passing 'str' and 'dict' lookup values to GDALRaster, when they represented rasters, could lead to file writing on disk or network requests. In some cases, this could enable remote code execution. The flaw was reachable by staff users with view permissions on any registered model containing a spatial field via the admin changelist.

To mitigate this, spatial lookups now disallow 'dict' and 'str' types that are not valid GEOSGeometry. This change is backward incompatible, and users needing to use these types in spatial lookups should consult the raster security considerations documentation for guidance on validation.

Denial-of-Service Vulnerabilities Patched

Two additional denial-of-service (DoS) vulnerabilities were also fixed. CVE-2026-15337, rated 'low' severity, affected 'django.utils.translation.check_for_language()'. This function was susceptible to DoS when processing many distinct, very long language codes, which could consume excessive process memory. The fix involves rejecting language codes longer than 500 characters before the cached lookup.

Another DoS vulnerability, CVE-2026-15830, was found in GEOSGeometry related to nested geometry collections. Details on this specific fix were not fully provided in the excerpt but it is part of the security release.

Impact and Recommendations

These updates are crucial for maintaining the security and stability of Django applications. The high-severity vulnerability could lead to significant compromise, including remote code execution, while the DoS vulnerabilities could disrupt service availability. All Django users should prioritize upgrading to Django 6.0.8 or 5.2.17 to protect their systems from these identified threats.