CVE-2026-15920 Details
Description
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.
A cross-site scripting vulnerability has been identified in Django versions 5.2 prior to 5.2.17 and 6.0 prior to 6.0.8. The issue arises in the admin interface, where URLField values are rendered as clickable links without proper validation. This allows potentially dangerous URLs to be displayed as links in changelist and read-only admin pages. If a staff user clicks on such a link, it could execute a script in their authenticated session. The vulnerability can be exploited if an unsafe URL has already been stored in the database. While URLField validation through a ModelForm or the admin rejects unsafe schemes, this issue affects applications that save URLField data without applying model validation, such as through direct queryset writes, deserialization, or bulk imports of untrusted input.
Users can upgrade to Django 5.2.17 or 6.0.8, both of which include the necessary fix. Instructions for downloading these versions are available on the Django website.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.djangoproject.com/en/dev/releases/security/ | Django Software Foundation | PatchVendor Advisory |
| https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b | Django Software Foundation | Patch |
| https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d | Django Software Foundation | Patch |
| https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a | Django Software Foundation | Patch |
| https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349 | Django Software Foundation | Patch |
| https://groups.google.com/g/django-announce | Django Software Foundation | Mailing List |
| https://www.djangoproject.com/weblog/2026/aug/04/security-releases/ | Django Software Foundation | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-83 | Improper Neutralization of Script in Attributes in a Web Page | Django Software Foundation |
Affected Products
| Product | Versions |
|---|---|
| djangoproject django | >= 5.2, < 5.2.17 >= 6.0, < 6.0.8 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 17, 2026 | Initial Analysis | [email protected] |
| Aug 4, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | Django Software Foundation |