{"action":"Upgrade django to 5.2.17 or later.","affected":[{"fixed":"5.2.17","introduced":"0"},{"fixed":"6.0.8","introduced":"6.0a1"}],"component":"django","cve_ids":["CVE-2026-15307"],"ecosystem":"PyPI","epss":0.01134,"exploited":false,"fixed_versions":["5.2.17","6.0.8"],"ghsa_id":"GHSA-wvqv-fj8w-qmhm","id":"tcs_01M5KG2YH1RV6SPBE0RYXY380A","modified_at":"2026-10-01T17:56:17.845009416Z","published_at":"2026-08-04T18:31:27Z","references":["https://osv.dev/vulnerability/GHSA-wvqv-fj8w-qmhm","https://nvd.nist.gov/vuln/detail/CVE-2026-15307","https://github.com/django/django/commit/115ffd0463a765ab1cc93de18e94b5459b8a300e","https://github.com/django/django/commit/208f80cb682868b584ed0a78f23e4ba6304212aa","https://github.com/django/django/commit/39b3e2d0c743a338def6c473086ebc06865e86b6","https://github.com/django/django/commit/f1949c1f9758947ade984c895ff16bef46f56520","https://docs.djangoproject.com/en/dev/releases/security","https://github.com/django/django","https://groups.google.com/g/django-announce","https://www.djangoproject.com/weblog/2026/aug/04/security-releases"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-wvqv-fj8w-qmhm","url":"https://osv.dev/vulnerability/GHSA-wvqv-fj8w-qmhm"}],"summary":"Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing"}