An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter submitted through the Django admin changelist query string by a staff user with view permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Bence Nagy, localhost-detect, and kimchunbok_ for reporting this issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups
    optimistically parse the right-hand-side value as a raster by passing it to the
    `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a
    `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a
    spatial-field filter submitted through the Django admin changelist query string by a staff user with view
    permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of
    the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be
    written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an
    outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later
    imported by the application can result in remote code execution. Earlier, unsupported Django series (such
    as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Bence
    Nagy, localhost-detect, and kimchunbok_ for reporting this issue. (CVE-2026-15307)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8848-1 advisory.

    Bence Nagy discovered that GeoDjango in Django incorrectly handled spatial lookups when processing     untrusted input. A remote attacker could possibly use this issue to make outbound network requests, write     arbitrary files, or execute arbitrary code. This issue was only addressed in Ubuntu 22.04 LTS, Ubuntu     24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-15307)

    Ahmad Sadeddin discovered that Django UpdateCacheMiddleware incorrectly cached requests where the Vary     header contained an asterisk. A remote attacker could possibly use this issue to obtain sensitive     information. (CVE-2026-6907)

    Ahmed Badawe discovered that Django did not properly parse Cache-Control response directives case-     insensitively under certain circumstances. A remote attacker could possibly use this issue to view     sensitive information from responses that were incorrectly cached. This issue only affected

    Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-8404)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6b28b4e483 advisory.

    Update `python-django5` to the latest 5.x release (5.2.17)

    - Fixes CVE-2026-15307 [high]: Server-side file-write and request forgery via spatial lookups
    - Fixes CVE-2026-15337 [low]: Potential denial-of-service vulnerability in check_for_language()
    - Fixes CVE-2026-15830 [moderate]: Potential denial-of-service vulnerability via nested geometry     collections
    - Fixes CVE-2026-15920 [moderate]: Potential cross-site scripting via URLField values in the admin

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-301e6e2983 advisory.

    Update `python-django5` to the latest 5.x release (5.2.17)

    - Fixes CVE-2026-15307 [high]: Server-side file-write and request forgery via spatial lookups
    - Fixes CVE-2026-15337 [low]: Potential denial-of-service vulnerability in check_for_language()
    - Fixes CVE-2026-15830 [moderate]: Potential denial-of-service vulnerability via nested geometry     collections
    - Fixes CVE-2026-15920 [moderate]: Potential cross-site scripting via URLField values in the admin

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-950089270f advisory.

    Update `python-django5` to the latest 5.x release (5.2.17)

    - Fixes CVE-2026-15307 [high]: Server-side file-write and request forgery via spatial lookups
    - Fixes CVE-2026-15337 [low]: Potential denial-of-service vulnerability in check_for_language()
    - Fixes CVE-2026-15830 [moderate]: Potential denial-of-service vulnerability via nested geometry     collections
    - Fixes CVE-2026-15920 [moderate]: Potential cross-site scripting via URLField values in the admin

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59135 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: notification backends allow SSRF and credential leakage (CVE-2026-71366)
    * automation-controller: webhook status callback SSRF leaks the Git PAT (CVE-2026-71365)
    * automation-controller: project archive extraction allows path traversal file writes (CVE-2026-71364)
    * automation-controller: AIOHTTP: Denial of Service via malformed HTTP responses (CVE-2026-69244)
    * automation-controller: pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886)
    * automation-controller: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()     (CVE-2026-34993)
    * automation-controller: path traversal via YAML !include directive (CVE-2026-52902)
    * automation-controller: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)
    * automation-gateway: path Traversal via unsanitized prefix/postfix enables directory escape     (CVE-2026-44705)
    * python3.12-aiohttp: HTTP Request Smuggling via WebSocket Upgrade (CVE-2026-69243)
    * python3.12-aiohttp: Denial of Service via malformed HTTP responses (CVE-2026-69244)
    * python3.12-django: Remote code execution via GeoDjango spatial lookups (CVE-2026-15307)
    * python3.12-gitpython: Command Injection via Git option prefix abbreviation (CVE-2026-67325)
    * python3.12-gitpython: Arbitrary Code Execution via Joined Short Options Bypass (CVE-2026-67324)
    * python3.12-gitpython: Arbitrary code execution via command injection due to unguarded Git options     (CVE-2026-67323)
    * python3.12-gitpython: Environment variable exfiltration via attacker-controlled clone URL     (CVE-2026-67322)
    * python3.12-gitpython: Arbitrary file overwrite and read via unsafe git option forwarding     (CVE-2026-73620)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59136 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: notification backends allow SSRF and credential leakage (CVE-2026-71366)
    * automation-controller: webhook status callback SSRF leaks the Git PAT (CVE-2026-71365)
    * automation-controller: project archive extraction allows path traversal file writes (CVE-2026-71364)
    * automation-controller: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade (CVE-2026-69243)
    * automation-controller: AIOHTTP: Denial of Service via malformed HTTP responses (CVE-2026-69244)
    * automation-controller: pyasn1: Denial of Service via crafted ASN.1 REAL values (CVE-2026-59886)
    * automation-controller: path traversal via YAML !include directive (CVE-2026-52902)
    * automation-controller: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()     (CVE-2026-34993)
    * automation-controller: daphne: Denial of Service via excessive WebSocket message size (CVE-2026-44545)
    * automation-controller: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)
    * automation-platform-ui: form-data: Form field override via CRLF injection (CVE-2026-12143)
    * automation-platform-ui: path Traversal via unsanitized prefix/postfix enables directory escape     (CVE-2026-44705)
    * python-django: Remote code execution via GeoDjango spatial lookups (CVE-2026-15307)
    * python3.12-aiohttp: HTTP Request Smuggling via WebSocket Upgrade (CVE-2026-69243)
    * python3.12-aiohttp: Denial of Service via malformed HTTP responses (CVE-2026-69244)
    * python3.12-django: Remote code execution via GeoDjango spatial lookups (CVE-2026-15307)
    * python3.12-gitpython: Command Injection via Git option prefix abbreviation (CVE-2026-67325)
    * python3.12-gitpython: Arbitrary Code Execution via Joined Short Options Bypass (CVE-2026-67324)
    * python3.12-gitpython: Arbitrary code execution via command injection due to unguarded Git options     (CVE-2026-67323)
    * python3.12-gitpython: Environment variable exfiltration via attacker-controlled clone URL     (CVE-2026-67322)
    * python3.12-gitpython: Arbitrary file overwrite and read via unsafe git option forwarding     (CVE-2026-73620)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59137 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller-cli: path traversal via YAML !include directive (CVE-2026-52902)
    * python-django: Django: Remote code execution via GeoDjango spatial lookups (CVE-2026-15307)
    * python3.12-django: Django: Remote code execution via GeoDjango spatial lookups (CVE-2026-15307)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    For details about this release, refer to the release notes listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0823 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-15307:
    An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups     optimistically parse the right-hand-side value as a raster by passing it to the     django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField     or RasterField reaches this constructor, including untrusted input. A dict, or a str holding its JSON     representation, is opened in write mode regardless of the constructor's write=False default, allowing a     file with an attacker-chosen name and contents to be written through a file-backed GDAL driver. Any other     str is treated as a datasource, allowing an outbound network request through a GDAL virtual filesystem     handler. Writing a file to a location later imported by the application can result in remote code     execution.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups
    optimistically parse the right-hand-side value as a raster by passing it to the
    `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a
    `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a
    spatial-field filter submitted through the Django admin changelist query string by a staff user with view
    permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of
    the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be
    written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an
    outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later
    imported by the application can result in remote code execution. Earlier, unsupported Django series (such
    as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Bence
    Nagy, localhost-detect, and kimchunbok_ for reporting this issue. (CVE-2026-15307)

  - An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
    `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when
    given many distinct, very long language codes, which are retained as keys in an in-memory cache and
    consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view,
    which is not routed by default. The consumed memory is bounded, since request data is limited by the
    `DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of
    entries. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may
    also be affected. Django would like to thank Jaeyoung Jang for reporting this issue. (CVE-2026-15337)

  - An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's
    `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply
    nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-
    encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library.
    Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected.
    Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be
    affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.
    (CVE-2026-15830)

  - An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
    `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin
    without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and
    read-only admin pages, which allows cross-site scripting against staff users who click the link.
    Exploitation requires the unsafe value to already be stored in the database. `URLField` validation through
    a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField`
    data without running model validation, for example through direct queryset writes, deserialization, or
    bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.
    (CVE-2026-15920)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21543-1 advisory.

    Changes in python-Django:

    - CVE-2026-15307: server-side file-write and request forgery via spatial lookups (bsc#1272997)
    - CVE-2026-15337: potential denial-of-service vulnerability in `check_for_language()` (bsc#1272998)
    - CVE-2026-15830: potential denial-of-service vulnerability via nested geometry collections (bsc#1272999)
    - CVE-2026-15920: potential cross-site scripting via `URLField` values in the admin (bsc#1273000)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The detected version of the Django Python package is 5.2.x prior to 5.2.17 or 6.0.x prior to 6.0.8. It is, therefore, affected by multiple vulnerabilities, including:

  - GeoDjango spatial lookups pass untrusted input to the GDALRaster constructor, allowing an attacker to write     arbitrary files via a file-backed GDAL driver or trigger outbound network requests via GDAL virtual filesystem     handlers, potentially resulting in remote code execution. (CVE-2026-15307)

  - django.contrib.admin.utils.display_for_field() renders URLField values as clickable links without validating     the URL scheme, allowing cross-site scripting against staff users who click a link with an unsafe scheme stored     in the database. (CVE-2026-15920)

  - django.utils.translation.check_for_language() retains many distinct, very long language codes as keys in an     in-memory cache, allowing a potential denial-of-service attack that consumes process memory. (CVE-2026-15337)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3503-1 advisory.

    - CVE-2026-15307: server-side file-write and request forgery via spatial lookups (bsc#1272997).
    - CVE-2026-15337: potential denial-of-service vulnerability in `check_for_language()` (bsc#1272998).
    - CVE-2026-15830: potential denial-of-service vulnerability via nested geometry collections (bsc#1272999).
    - CVE-2026-15920: potential cross-site scripting via `URLField` values in the admin (bsc#1273000).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups     optimistically parse the right-hand-side value as a raster by passing it to the     `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a     `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a     spatial-field filter submitted through the Django admin changelist query string by a staff user with view     permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of     the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be     written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an     outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later     imported by the application can result in remote code execution. Earlier, unsupported Django series (such     as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Bence     Nagy, localhost-detect, and kimchunbok_ for reporting this issue. (CVE-2026-15307)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
471652	Chainguard: authentik-2026.2: security update to 2026.2.7-r3	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
471652	Chainguard: authentik-2026.2: security update to 2026.2.7-r3	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
471219	Echo: django: security update to 5.2.17	Tenable Cloud Security	Echo Local Security Checks	Local	high
471219	Echo: django: security update to 5.2.17	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
362565	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Django vulnerabilities (USN-8848-1)	Nessus	Ubuntu Local Security Checks	Local	high
347939	Fedora 43 : python-django5 (2026-6b28b4e483)	Nessus	Fedora Local Security Checks	Local	high
347932	Fedora 44 : python-django5 (2026-301e6e2983)	Nessus	Fedora Local Security Checks	Local	high
346998	Fedora 45 : python-django5 (2026-950089270f)	Nessus	Fedora Local Security Checks	Local	high
339184	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2026:59135)	Nessus	Red Hat Local Security Checks	Local	critical
339179	RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:59136)	Nessus	Red Hat Local Security Checks	Local	critical
339136	RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update (Important) (RHSA-2026:59137)	Nessus	Red Hat Local Security Checks	Local	high
334822	TencentOS Server 4: python-django (TSSA-2026:0823)	Nessus	Tencent Local Security Checks	Local	high
445846	Alpine: multiple py3-django packages: security update to 5.2.17-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
445846	Alpine: multiple py3-django packages: security update to 5.2.17-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
333512	openSUSE 16 Security Update : python-Django (openSUSE-SU-2026:21543-1)	Nessus	SuSE Local Security Checks	Local	high
333309	Python Library Django 5.2.x < 5.2.17 / 6.0.x < 6.0.8 Multiple Vulnerabilities	Nessus	Misc.	Local	high
333043	SUSE SLES15 Security Update : python-Django (SUSE-SU-2026:3503-1)	Nessus	SuSE Local Security Checks	Local	high
332074	Linux Distros Unpatched Vulnerability : CVE-2026-15307	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-15307

high

Tenable Plugins

high

high

high

high

high

high

high

high

critical

critical

high

high

high

high

high

high

high

high