CVE-2026-1207mediumobserved exploitationCWE-89

CVE-2026-1207: medium-severity vulnerability in djangoproject Django

Potential SQL injection via raster lookups on PostGIS

Published · Updated

Follow this CVE+ Monitor Django+ Monitor python-django

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

55Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 5.4epss 13%
from disclosure to weapon
Published on NVDFeb 3
VulnCheck+23d
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected products
djangoproject · Django
Related CVEs — djangoproject Django

In the same product, most dangerous first.

CVE-2025-57833HIGHCVE-2025-57833EPSS 28.3%CVE-2025-64459CRITICALPotential SQL injection via _connector keyword argument in QuerySet and Q objectsEPSS 19.3%CVE-2025-32873MEDIUMCVE-2025-32873EPSS 14.3%CVE-2025-64460HIGHPotential denial-of-service vulnerability in XML serializer text extractionEPSS 2.2%CVE-2025-64458HIGHPotential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on WindowsEPSS 1.9%CVE-2024-56374MEDIUMCVE-2024-56374EPSS 1.3%