VDB
RHSA-2026:59135
RHSA-2026:59135
PUBLISHED
CVSS 6.5 MEDIUM
Record from redhat · Published August 24, 2026
A flaw was found in Django. GeoDjango's spatial lookups can be exploited by a staff user with view permissions who submits a specially crafted spatial-field filter. This vulnerability allows an attacker to write arbitrary files to the server, which can lead to remote code execution. Additionally, it can be used to make outbound network requests, resulting in server-side request forgery.
Risk scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | automation-controller-0:4.6.32-1.el8ap.s390x as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:4.6.32-1.el8ap |
| Red Hat | python3.12-aiohttp-0:3.14.3-1.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:3.14.3-1.el9ap |
| Red Hat | python3.12-galaxy-ng-0:4.10.18-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:4.10.18-1.el8ap |
| Red Hat | automation-hub-0:4.10.18-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:4.10.18-1.el9ap |
| Red Hat | automation-controller-0:4.6.32-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:4.6.32-1.el9ap |
| Red Hat | automation-controller-cli-0:4.6.32-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:4.6.32-1.el9ap |
| Red Hat | automation-controller-ui-0:4.6.32-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:4.6.32-1.el8ap |
| Red Hat | automation-controller-venv-tower-0:4.6.32-1.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:4.6.32-1.el9ap |
| Red Hat | python3.12-aiohttp-debugsource-0:3.14.3-1.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:3.14.3-1.el9ap |
| Red Hat | automation-hub-0:4.10.18-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:4.10.18-1.el9ap |
| Red Hat | automation-controller-0:4.6.32-1.el8ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:4.6.32-1.el8ap |
| Red Hat | automation-eda-controller-0:1.1.22-1.el8ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:1.1.22-1.el8ap |
| Red Hat | automation-gateway-0:2.5.20260824-1.el8ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:2.5.20260824-1.el8ap |
| Red Hat | python3.12-aiohttp-0:3.14.3-1.el8ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:3.14.3-1.el8ap |
| Red Hat | python3.12-aiohttp-debugsource-0:3.14.3-1.el8ap.ppc64le as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:3.14.3-1.el8ap |
| Red Hat | automation-gateway-server-0:2.5.20260824-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:2.5.20260824-1.el9ap |
| Red Hat | python3.12-galaxy-ng-0:4.10.18-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:4.10.18-1.el9ap |
| Red Hat | python3.12-django-0:5.2.17-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:5.2.17-1.el8ap |
| Red Hat | automation-gateway-config-0:2.5.20260824-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 0:2.5.20260824-1.el8ap |
| Red Hat | python3.12-aiohttp-0:3.14.3-1.el9ap.s390x as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9 | 0:3.14.3-1.el9ap |
…and 66 more
Timeline
- Aug 24, 2026 CVE Published
- Sep 15, 2026 CVE Updated
- Sep 15, 2026 Distribution Patch (2 in total, the first dated here)
- Sep 15, 2026 Security Advisory (18 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln RHSA-2026:59135
vulnetix vdb fixes RHSA-2026:59135Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/RHSA-2026%3A59135/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://access.redhat.com/errata/RHSA-2026:59135 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases advisory
- https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2456187 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2484099 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2486729 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2487946 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2500041 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2509975 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2509976 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2510021 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2510032 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2510825 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2510831 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2511095 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2511900 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2511901 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2511902 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2515261 issue
…and 87 more