Detections
Analytics
Alpine: multiple py3-django packages: security update to 5.2.17-r0
high Tenable Cloud Security Plugin ID 445846
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups
optimistically parse the right-hand-side value as a raster by passing it to the
`django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a
`GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a
spatial-field filter submitted through the Django admin changelist query string by a staff user with view
permission. A `dict`, or a `str` holding its JSON representation, is opened in write mode regardless of
the constructor's `write=False` default, allowing a file with an attacker-chosen name and contents to be
written through a file-backed GDAL driver. Any other `str` is treated as a datasource, allowing an
outbound network request through a GDAL virtual filesystem handler. Writing a file to a location later
imported by the application can result in remote code execution. Earlier, unsupported Django series (such
as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Bence
Nagy, localhost-detect, and kimchunbok_ for reporting this issue. (CVE-2026-15307)
- An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
`django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when
given many distinct, very long language codes, which are retained as keys in an in-memory cache and
consume process memory. Such codes reach the function through the `django.views.i18n.set_language()` view,
which is not routed by default. The consumed memory is bounded, since request data is limited by the
`DATA_UPLOAD_MAX_MEMORY_SIZE` setting (default 2.5 MB) and the cache holds a fixed maximum number of
entries. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may
also be affected. Django would like to thank Jaeyoung Jang for reporting this issue. (CVE-2026-15337)
- An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's
`django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply
nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), well-known binary (WKB), or hex-
encoded WKB, which triggers unbounded recursion and a segmentation fault in the underlying GEOS library.
Spatial field lookups and the `django.contrib.gis.forms.GeometryField` form field are also affected.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be
affected. Django would like to thank Andrew MacPherson and kimchunbok_ for reporting this issue.
(CVE-2026-15830)
- An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin
without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and
read-only admin pages, which allows cross-site scripting against staff users who click the link.
Exploitation requires the unsafe value to already be stored in the database. `URLField` validation through
a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField`
data without running model validation, for example through direct queryset writes, deserialization, or
bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.
(CVE-2026-15920)
Solution
Update the py3-django library and its related packages to version 5.2.17-r0 or later.See Also
https://security.alpinelinux.org/vuln/CVE-2026-15307
https://security.alpinelinux.org/vuln/CVE-2026-15337
Plugin Details
Severity: High
ID: 445846
Version: Revision 1.1
Type: Local
Published: 8/10/2026
Updated: 8/10/2026
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Medium
Score: 6.9
Percentile: 96.82
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 6.7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2026-15307
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.7
Threat Score: 6.3
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 8/4/2026
Reference Information
CVE: CVE-2026-15307, CVE-2026-15337, CVE-2026-15830, CVE-2026-15920