ALPINE-CVE-2026-111211: Medium severity alpine/py3-django vulnerability
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize(), used by django.contrib.gis.forms.GeometryField, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Aaron chen for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 5.2.19-r0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using django.contrib.gis.forms.GeometryField are exposed when they process attacker-controlled geometry submissions that fail deserialization and log the invalid value. Applications that do not use this GIS form field are not identified as affected by the available information.
What does an attacker need to exploit it?
An attacker needs network access to submit a crafted geometry value to an affected GeometryField. No authentication or user interaction is required according to the provided severity vector.
Which Django versions have fixes available?
The issue is fixed in Django 6.1.3, 6.0.10, and 5.2.19. It affects versions before those releases within the 6.1, 6.0, and 5.2 series.
Are older unsupported Django releases safe?
No conclusion can be made for unsupported series such as 5.1.x, 5.0.x, and 4.2.x. They were not evaluated and may also be affected.