Detections
Analytics

CVE-2026-1207

critical

Description

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

References

https://www.djangoproject.com/weblog/2026/feb/03/security-releases/

https://docs.djangoproject.com/en/dev/releases/security/

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1207.json

https://groups.google.com/g/django-announce

https://bugzilla.redhat.com/show_bug.cgi?id=2436338

https://access.redhat.com/security/cve/CVE-2026-1207

https://access.redhat.com/errata/RHSA-2026:6291

https://access.redhat.com/errata/RHSA-2026:5971

https://access.redhat.com/errata/RHSA-2026:5970

https://access.redhat.com/errata/RHSA-2026:3962

https://access.redhat.com/errata/RHSA-2026:3960

https://access.redhat.com/errata/RHSA-2026:3959

https://access.redhat.com/errata/RHSA-2026:3958

https://access.redhat.com/errata/RHSA-2026:2694

https://access.redhat.com/errata/RHSA-2026:14835

Details

Source: Mitre, NVD

Published: 2026-02-03

Updated: 2026-07-15

Risk Information

CVSS v2

Base Score: 7.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Severity: High

CVSS v4

Base Score: 9.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: Critical

EPSS

EPSS: 0.00017