CVE-2026-87890: CWE-918: Server-Side Request Forgery (SSRF) in djangoproject Django

This vulnerability in Django involves an incomplete remediation of a prior SSRF flaw in spatial lookups. Specifically, an attacker capable of providing crafted bytes input can exploit the handling of VRT documents that reference external raster sources to induce the Django server to make network requests. The affected versions are Django 5.2 before 5.2.18, 6.0 before 6.0.9, and 6.1 before 6.1.2. The issue was reported by the security researcher sicksec. No known exploits are reported in the wild at this time.

An attacker able to supply crafted bytes values can cause the Django server to make unintended network requests, potentially leading to SSRF-related impacts such as information disclosure or interaction with internal network resources. The CVSS score of 5.3 reflects a medium severity with low complexity and no privileges or user interaction required. There is no indication of direct integrity or availability impact.

Fixed versions are available: Django 5.2.18, 6.0.9, and 6.1.2 address this vulnerability. Users should upgrade to these or later versions to remediate the issue. No vendor advisory content was provided, but the presence of fixed versions indicates an official fix is available. There is no mention of alternative mitigations or temporary workarounds.