{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-114582","assignerOrgId":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","state":"PUBLISHED","assignerShortName":"DSF","dateReserved":"2026-10-21T18:36:16.193Z","datePublished":"2026-11-03T15:43:04.441Z","dateUpdated":"2026-11-03T18:26:08.053Z"},"containers":{"cna":{"providerMetadata":{"orgId":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","shortName":"DSF","dateUpdated":"2026-11-03T15:43:04.441Z"},"problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-918","description":"CWE-918: Server-Side Request Forgery","type":"CWE"}]}],"impacts":[{"capecId":"CAPEC-664","descriptions":[{"lang":"en","value":"CAPEC-664: Server Side Request Forgery"}]}],"title":"Server-side request forgery via SpatialReference string input","metrics":[{"other":{"content":{"value":"low","namespace":"https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels"},"type":"Django severity rating"}},{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM"}},{"cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":6.9,"baseSeverity":"MEDIUM"}}],"descriptions":[{"lang":"en","value":"An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\n`django.contrib.gis.gdal.SpatialReference` (and related `transform()` methods and `srs`/`srid` setters) do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger server-side requests or local file reads via crafted spatial reference strings.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Adraca for reporting this issue.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.</p><p><code>django.contrib.gis.gdal.SpatialReference</code> (and related <code>transform()</code> methods and <code>srs</code>/<code>srid</code> setters) do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger server-side requests or local file reads via crafted spatial reference strings.</p><p>Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.</p><p>Django would like to thank Adraca for reporting this issue.</p>"}]}],"affected":[{"collectionURL":"https://pypi.org/project/Django/","defaultStatus":"unaffected","packageName":"django","product":"Django","repo":"https://github.com/django/django/","vendor":"djangoproject","versions":[{"status":"affected","version":"6.1","lessThan":"6.1.3","versionType":"python"},{"status":"unaffected","version":"6.1.3","versionType":"python"},{"status":"affected","version":"6.0","lessThan":"6.0.10","versionType":"python"},{"status":"unaffected","version":"6.0.10","versionType":"python"},{"status":"affected","version":"5.2","lessThan":"5.2.19","versionType":"python"},{"status":"unaffected","version":"5.2.19","versionType":"python"}]}],"references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","name":"Django security archive","tags":["vendor-advisory"]},{"url":"https://groups.google.com/g/django-announce","name":"Django releases announcements","tags":["mailing-list"]},{"tags":["patch"],"url":"https://github.com/django/django/commit/3a2ec4378b53c7b8ff5283ad7eba624ffa6f2b2f"},{"tags":["patch"],"url":"https://github.com/django/django/commit/a658355eb51feccbe90b5ca2e3b7f3543cd99e01"},{"tags":["patch"],"url":"https://github.com/django/django/commit/1c980729e53ef119d43a01d32ead30116c46cd36"},{"tags":["patch"],"url":"https://github.com/django/django/commit/8bda4d0db15f28828d8db000287562efae5ce063"},{"url":"https://www.djangoproject.com/weblog/2026/nov/03/security-releases/","name":"Django security releases issued: 6.1.3, 6.0.10, and 5.2.19","tags":["vendor-advisory"]}],"credits":[{"lang":"en","type":"reporter","value":"Adraca"},{"lang":"en","type":"analyst","value":"Jake Howard"},{"lang":"en","type":"analyst","value":"Jacob Walls"},{"lang":"en","type":"remediation developer","value":"Jacob Walls"},{"lang":"en","type":"remediation reviewer","value":"Sarah Boyce"},{"lang":"en","type":"remediation reviewer","value":"David Smith"},{"lang":"en","type":"coordinator","value":"Jacob Walls"}],"timeline":[{"lang":"en","time":"2026-08-05T12:00:00.000Z","value":"Initial report received."},{"lang":"en","time":"2026-10-21T12:00:00.000Z","value":"Vulnerability confirmed."},{"lang":"en","time":"2026-11-03T09:30:00.000Z","value":"Security release issued."}],"datePublic":"2026-11-03T09:30:00.000Z","source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-11-03T17:51:27.198636Z","id":"CVE-2026-114582","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-11-03T18:26:08.053Z"}}]}}