Django's August 4, 2026 security releases patch four vulnerabilities across all supported branches. The most serious — CVE-2026-15307 — affects sites using GeoDjango with GDALRaster spatial lookups and can allow server-side file writes with a path toward remote code execution. Three additional flaws cover denial-of-service and stored cross-site scripting vectors. Fixed versions are Django 6.0.8 and Django 5.2.17, both released August 4, 2026.

The Four CVEs at a Glance

  • CVE-2026-15307 — High severity — Server-side file write / request forgery via GeoDjango spatial lookups
    When an application uses Django's GeoDjango with GDALRaster-backed spatial lookups, a crafted lookup value can cause Django to write a file to an arbitrary server path or forge a server-side HTTP request. Depending on the web server's filesystem permissions and what services it can reach internally, this primitive can be escalated toward remote code execution by writing to cron directories, app startup hooks, or similar writable locations. Only sites with GeoDjango + GDALRaster enabled are exposed.
  • CVE-2026-15337 — Low severity — DoS via long language codes in check_for_language()
    The internationalization middleware caches the result of check_for_language() per Accept-Language value. Because the input is not bounded in length, a remote attacker can send arbitrarily long Accept-Language headers and cause the cache to consume excessive memory, degrading or crashing the application. Sites using Django's LocaleMiddleware or i18n_patterns are affected.
  • CVE-2026-15830 — Moderate severity — DoS via deeply nested GEOMETRYCOLLECTION objects
    GEOSGeometry objects parsed from deeply nested GEOMETRYCOLLECTION inputs cause excessive memory consumption and can exhaust server resources. Sites accepting user-controlled geometry inputs in any form are affected.
  • CVE-2026-15920 — Moderate severity — Stored XSS via URLField values in Django admin
    URLField values that begin with the javascript: URI scheme are rendered as clickable links in the Django admin interface. A user who can save a record with a URLField (an editor, moderator, or any model with a URLField) can inject a stored XSS payload that executes in an administrator's browser when the record is opened in admin. Sites using Django admin with user-editable URLField values are affected.

Affected and Fixed Versions

All four CVEs affect the same version range:

  • Django main (development branch) — fix applied
  • Django 6.1 RC — fix applied
  • Django 6.0 → upgrade to 6.0.8
  • Django 5.2 → upgrade to 5.2.17

Django 4.2 reached end of life in April 2026. If you are still running it, these CVEs may or may not apply, but you are already in an unsupported state and should upgrade regardless.

Who Is Affected?

CVE-2026-15307 (High): Sites must be using GeoDjango with a GDALRaster-backed spatial field. Most Django deployments do not use GeoDjango at all; if the words "GDALRaster" or "spatial lookups" don't appear in your models or settings, you are not exposed to the high-severity flaw. It is still worth patching for the other three CVEs.

CVE-2026-15337: Sites using LocaleMiddleware (the typical i18n setup) or URL patterns wrapped in i18n_patterns(). This covers most multi-language Django sites.

CVE-2026-15830: Any view that processes GEOSGeometry objects from user input — forms, API endpoints, import tools.

CVE-2026-15920: Any site running Django admin where users who are not superadmins can create or edit records containing URLField values.

What to Do

  1. Upgrade Django immediately. 
    # Check your current version
python -m django --version

# Upgrade in your virtualenv
pip install "django==6.0.8"   # or 5.2.17 for the LTS branch

# Confirm
python -m django --version
  2. Restart your application. Django reads files from disk; once the package is upgraded, restart Gunicorn, uWSGI, or your ASGI server to load the new code: 
    sudo systemctl restart gunicorn
# or, if using Supervisor:
supervisorctl restart myapp
  3. If you use GeoDjango with GDALRaster lookups, audit your lookup inputs. Until the upgrade is in place, add server-side validation to reject untrusted input in spatial lookups. Do not rely on client-side checks alone.
  4. Review Django admin URLField permissions. If you cannot upgrade immediately, restrict who can save records with URLField values in admin, or temporarily use a read-only widget for those fields in admin views. After upgrading, audit stored records for javascript: URLs that may have been saved before the patch.
  5. If you accept geometry data from users, add input size limits at the API boundary to reject abnormally deep or large GEOMETRYCOLLECTION objects while waiting to patch CVE-2026-15830.

Quick-Win Checklist

  • Run python -m django --version — confirm 6.0.8 or 5.2.17.
  • Upgrade via pip and restart your application server.
  • If you use GeoDjango + GDALRaster: restrict spatial lookup inputs until patched.
  • If you use Django admin with URLFields: audit stored URLs for javascript: schemes.
  • If you accept geometry input from users: add size/depth limits at the API layer.
  • Check for any pinned Django version in requirements.txt or pyproject.toml that would block the upgrade and remove the pin.

Sources