VDB
DEBIAN-CVE-2026-1207
DEBIAN-CVE-2026-1207
PUBLISHED
CVSS 5.400000095367432 MEDIUM
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.
Risk Scores
CVSS 3.1
5.400000095367432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | python-django | 3:4.2.23-1, 3:4.2.24-1, 3:4.2.25-2 |
| Debian:14 | python-django | 3:4.2.23-1, 3:4.2.26-1, 3:4.2.27-2 |
| Debian:12 | python-django | 0, 3:3.2.19-1, 3:3.2.19-1+deb12u1~bpo11+1 |
| Debian:11 | python-django | *, 2:2.2.24-1, 2:2.2.26-1~deb11u1 |
Timeline
- Feb 3, 2026 CVE Published
- Apr 28, 2026 CVE Updated