Django Patches Six Vulnerabilities in Versions 6.1.3, 6.0.10, and 5.2.19
Django has released versions 6.1.3, 6.0.10, and 5.2.19 to address six security vulnerabilities, including two SSRF issues in GIS components.
Django versions 6.1.3, 6.0.10, and 5.2.19 are now available, fixing six vulnerabilities spanning GIS components, file uploads, caching, and the admin interface. You should upgrade immediately.
CVE-2026-111362 is a moderate server-side request forgery in GeoJSON geometry handling. Spatial lookups, GeometryField, and GEOSGeometry now reject GeoJSON geometries whose CRS points to an external resource, while trusted data utilities like DataSource and LayerMapping still accept them.
Five low-severity vulnerabilities are also patched. CVE-2026-114582 is a second SSRF involving GDAL string input in SpatialReference, which Django now mitigates by disabling network and file access when parsing string input on GDAL 3.9 and later, alongside a new system check, gis.W001.
Ignacy Kujawa reported CVE-2026-108147, where MultiPartParser buffered base64-encoded multipart uploads entirely in memory. Aaron Chen reported CVE-2026-111211 regarding unescaped control characters in GeometryField logs, and CVE-2026-113733 concerning password hash exposure in the admin for users with only view permissions on non-standard user models. Finally, Andrew Gonzalez reported CVE-2026-113593, a caching issue where UpdateCacheMiddleware and cache_page() produced identical cache keys for absent and empty Vary headers.
The Submersion Security Research Team and Adraca credited the SSRF findings. The releases are signed with Jacob Walls's PGP key ID 131403F4D16D8DC7.