The vulnerability arises from GeoDjango spatial lookups parsing the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Untrusted input, such as spatial-field filters submitted via the Django admin changelist query string by staff users with view permission, can reach this constructor. A dict or JSON string is opened in write mode regardless of the default write=False setting, enabling file creation with attacker-controlled names and contents via a file-backed GDAL driver. Other strings are treated as data sources, potentially causing outbound network requests through a GDAL virtual filesystem handler. Writing a file to a location later imported by the application can result in remote code execution. Affected versions include Django 5.2 before 5.2.17 and 6.0 before 6.0.8. Earlier unsupported versions may also be vulnerable. The CVSS 3.1 score is 8.8 (high severity) with network attack vector, low attack complexity, requiring privileges (PR:L), no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with staff user view permissions can exploit this vulnerability to write files with attacker-controlled names and contents on the server or cause outbound network requests. If the application imports the maliciously written files, this can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict staff user permissions to minimize exposure, and avoid using untrusted input in spatial lookups. Monitor vendor channels for updates and apply official patches once available.