CVE-2026-114582 Details

A server-side request forgery vulnerability has been identified in Django versions 6.1 prior to 6.1.3, 6.0 prior to 6.0.10, and 5.2 prior to 5.2.19. The issue arises in the 'django.contrib.gis.gdal.SpatialReference' class, where certain methods do not properly restrict GDAL's file and network access when processing string inputs. This oversight allows attackers to manipulate spatial reference strings, potentially leading to unauthorized server-side requests or local file reads. The vulnerability is particularly concerning because GDAL, by default, resolves file and network references, a behavior that was not documented by Django. Similar vulnerabilities were also present in earlier, unsupported Django versions (such as 5.1.x, 5.0.x, and 4.2.x) and may still be exploitable.

Users can upgrade to Django versions 6.1.3, 6.0.10, or 5.2.19, where this vulnerability has been fixed. Instructions for upgrading can be found in the Django release notes.