GDALRaster

Critical Django Vulnerability CVE-2026-15307 Enables Remote Code Execution via GDALRaster Spatial Queries

The Django project has released versions 6.0.8 and 5.2.17 to address four vulnerabilities that could result in arbitrary file writes, unauthorized requests, denial of service, and cross-site scripting attacks. The most severe issue, tracked as CVE-2026-15307, impacts spatial queries that process raster data through the GDALRaster interface. Attackers can supply specially crafted values that cause the Django process to write files or initiate external connections under its own permissions, potentially leading to remote code execution in certain configurations. Exploitation is also possible through the Django admin panel when a staff user has view permissions on models containing geographic fields. The patches have been backported to the 5.2 and 6.0 branches as well as the upcoming 6.1 release candidate. In addition to fixing the flaw, the updates alter query behavior to reject dictionaries and strings that do not represent valid geometries.