CVE-2026-111362 Details

A server-side request forgery vulnerability has been identified in Django versions 6.1 prior to 6.1.3, 6.0 prior to 6.0.10, and 5.2 prior to 5.2.19. The issue arises in the 'django.contrib.gis.gdal.OGRGeometry' component, which fails to properly restrict external coordinate reference system (CRS) definitions in GeoJSON input. This oversight allows remote attackers to craft GeoJSON data that, when processed, can trigger server-side requests to locations of the attacker's choosing, potentially leading to unauthorized data exposure or other malicious outcomes. The vulnerability is particularly concerning because Django's GeoJSON parser, while outdated, still supports these CRS definitions and can resolve them to file or network locations.

Users can upgrade to Django versions 6.1.3, 6.0.10, or 5.2.19, where this vulnerability has been patched. Instructions for updating Django can be found in the Django documentation.