Skip to content
OpenAdvisories
Medium · 5.4 Scanner template Public exploit CVE-2026-1207 BIT-django-2026-1207EUVD-2026-5253GHSA-mwm9-4648-f68qPYSEC-2026-44

Potential SQL injection via raster lookups on PostGIS

Published Feb 3, 2026 · Updated Jul 15, 2026 · Assigned by DSF

Vendor: djangoproject Product: Django Package: django Package: py3-django Package: python-django Package: python-django Ecosystem: Alpine Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu

Description

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Tarek Nakkouch for reporting this issue.

Affected products

VendorProductAffectedFixed
djangoproject Django 6.0 – < 6.0.2, 5.2 – < 5.2.11, 4.2 – < 4.2.28 6.0.2

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 python-django 3:4.2.28-1 —
Debian 13 python-django 3:4.2.28-0+deb13u1 DSA-6150-1
Debian 12 python-django 3:3.2.25-0+deb12u2 DSA-6150-1
Debian 11 python-django 2:2.2.28-1~deb11u12 DLA-4484-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 python-django 3:5.2.4-1ubuntu2.3 —
Ubuntu 24.04 LTS python-django 3:4.2.11-1ubuntu1.14 —
Ubuntu 22.04 LTS python-django 2:3.2.12-2ubuntu1.25 —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS python-django 2:2.2.12-1ubuntu0.29+esm7 —
Ubuntu Pro 18.04 LTS python-django 1:1.11.11-1ubuntu1.21+esm14 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Satellite Utils 6 foreman +1 3.12.0.14-1.el8sat RHSA-2026:5971, RHSA-2026:5970
Red Hat Satellite Utils 6 satellite +1 6.17.7-1.el9sat RHSA-2026:5970
Red Hat Satellite Maintenance 6 libcomps +1 0.1.23-0.3.el9pc RHSA-2026:5970
Red Hat Satellite Capsule 6 foreman +2 3.12.0.14-1.el8sat RHSA-2026:5971, RHSA-2026:5970
Red Hat Satellite Capsule 6 libcomps +2 0.1.23-0.3.el9pc RHSA-2026:5970
Red Hat Satellite Capsule 6 python-brotli +1 1.2.0-0.1.el8pc RHSA-2026:5971, RHSA-2026:5970
Red Hat Satellite Capsule 6 python-django +1 4.2.28-0.1.el8pc RHSA-2026:5971, RHSA-2026:5970
Red Hat Satellite Capsule 6 python-pulp-container +1 2.22.3-1.el9pc RHSA-2026:5970
Red Hat Satellite Capsule 6 python-pulp-rpm +1 3.27.10-2.el9pc RHSA-2026:5970
Red Hat Satellite Capsule 6 python3.12-django 4.2.30-1.el9pc RHSA-2026:14835
Red Hat Satellite Capsule 6 python3.12-markdown 3.8.2-1.el9pc RHSA-2026:14835
Red Hat Satellite Capsule 6 python3.12-pyOpenSSL 26.0.0-2.el9pc RHSA-2026:14835
Red Hat Satellite Capsule 6 rubygem-activesupport 7.0.8.7-2.el9sat RHSA-2026:14835
Red Hat Satellite Capsule 6 rubygem-rubyipmi 0.13.0-0.1.el8sat RHSA-2026:5971, RHSA-2026:5970
Red Hat Satellite Capsule 6 satellite +3 6.17.7-1.el9sat RHSA-2026:5970
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Satellite 6 foreman +14 3.12.0.14-1.el8sat RHSA-2026:5971, RHSA-2026:5970
Red Hat Satellite 6 libcomps +2 0.1.23-0.3.el9pc RHSA-2026:5970
Red Hat Satellite 6 python-brotli +1 1.2.0-0.1.el8pc RHSA-2026:5971, RHSA-2026:5970
Red Hat Satellite 6 python-django +1 4.2.28-0.1.el8pc RHSA-2026:5971, RHSA-2026:5970
Red Hat Satellite 6 python-pulp-container +1 2.22.3-1.el9pc RHSA-2026:5970
Red Hat Satellite 6 python-pulp-rpm +1 3.27.10-2.el9pc RHSA-2026:5970
Red Hat Satellite 6 python3.12-django 4.2.30-1.el9pc RHSA-2026:14835
Red Hat Satellite 6 python3.12-markdown 3.8.2-1.el9pc RHSA-2026:14835
Red Hat Satellite 6 python3.12-pyOpenSSL 26.0.0-2.el9pc RHSA-2026:14835
Red Hat Satellite 6 rubygem-activesupport 7.0.8.7-2.el9sat RHSA-2026:14835
Red Hat Satellite 6 rubygem-fog-kubevirt 1.5.1-1.el8sat RHSA-2026:5971, RHSA-2026:5970
Red Hat Satellite 6 rubygem-foreman_kubevirt 0.2.0-2.el8sat RHSA-2026:5971, RHSA-2026:5970
Red Hat Satellite 6 rubygem-katello 4.16.0.14-1.el9sat RHSA-2026:5970
Red Hat Satellite 6 rubygem-rubyipmi 0.13.0-0.1.el8sat RHSA-2026:5971, RHSA-2026:5970
Red Hat Satellite 6 satellite +3 6.17.7-1.el9sat RHSA-2026:5970
Red Hat Satellite 6 yggdrasil-worker-forwarder 0.0.3-4.el8sat RHSA-2026:5971, RHSA-2026:5970
Red Hat Ansible Automation Platform Inside 2 receptor +1 1.6.3-4.el8ap RHSA-2026:3959, RHSA-2026:3958
Red Hat Ansible Automation Platform Developer 2 automation-controller +1 4.6.26-1.el8ap RHSA-2026:3959, RHSA-2026:3958
Red Hat Ansible Automation Platform Developer 2 python3.12-django 4.2.28-1.el8ap RHSA-2026:3959, RHSA-2026:3958
Red Hat Ansible Automation Platform Developer 2 receptor +1 1.6.3-4.el8ap RHSA-2026:3959, RHSA-2026:3958
Red Hat Ansible Automation Platform 2 automation-controller +4 4.6.26-1.el8ap RHSA-2026:3959, RHSA-2026:3958
Red Hat Ansible Automation Platform 2 automation-gateway +2 2.5.20260225-1.el8ap RHSA-2026:3959
Red Hat Ansible Automation Platform 2 automation-platform-ui 2.6.6-1.el9ap RHSA-2026:3958
Red Hat Ansible Automation Platform 2 python3.12-aiohttp 3.13.3-2.el8ap RHSA-2026:3959, RHSA-2026:3958
Red Hat Ansible Automation Platform 2 python3.12-django 4.2.28-1.el8ap RHSA-2026:3959, RHSA-2026:3958
Red Hat Ansible Automation Platform 2 python3.12-protobuf 5.29.6-1.el8ap RHSA-2026:3959, RHSA-2026:3958
Red Hat Ansible Automation Platform 2 receptor +1 1.6.3-4.el8ap RHSA-2026:3959, RHSA-2026:3958

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 python-Django 4.2.11-150600.3.47.1 SUSE-SU-2026:0440-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-Django 5.2.11-1.1 openSUSE-SU-2026:10160-1
openSUSE Tumbleweed python-Django4 4.2.28-1.1 openSUSE-SU-2026:10247-1
openSUSE Tumbleweed python-Django5 5.2.16-1.1 openSUSE-SU-2026:11270-1
openSUSE Tumbleweed python-Django6 6.0.2-1.1 openSUSE-SU-2026:10145-1
openSUSE Leap 16.0 python-Django 5.2.4-bp160.5.1 openSUSE-SU-2026:20184-1
openSUSE Leap 15.6 python-Django 4.2.11-150600.3.47.1 SUSE-SU-2026:0440-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 py3-django 4.2.28-r0 —
Alpine v3.23 py3-django 4.2.28-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • sw0rd1ight/CVE-2026-1207 ★ 3 · Apr 26, 2026

    Django 框架在使用 PostGIS 查询地理栅格（raster）数据时，若将未经验证的用户输入直接作为 band index（波段索引）参数，会引发 SQL 注入

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI django >= 6.0a1, < 6.0.2 6.0.2 GHSA-mwm9-4648-f68q
PyPI django >= 5.2a1, < 5.2.11 5.2.11 GHSA-mwm9-4648-f68q
PyPI django >= 4.2a1, < 4.2.28 4.2.28 GHSA-mwm9-4648-f68q
PyPI django >= 4.2, < 4.2.28 · >= 5.2, < 5.2.11 · >= 6.0, < 6.0.2 4.2.28, 5.2.11, 6.0.2 PYSEC-2026-44

Advisories 17

References