ALPINE-CVE-2026-114582: Medium severity alpine/py3-django vulnerability
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference (and related transform() methods and srs/srid setters) do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger server-side requests or local file reads via crafted spatial reference strings. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Adraca for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 5.2.19-r0 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 6.1.3 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 6.0.10 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.2.19
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using django.contrib.gis.gdal.SpatialReference or related transform() methods or srs/srid setters with attacker-controlled spatial reference strings are exposed. The issue affects Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
What does an attacker need to exploit it?
An attacker needs a way to cause the application to parse a crafted spatial reference string through the affected GIS interfaces. No authentication or user interaction is required according to the provided severity vector.
What could exploitation allow?
A crafted spatial reference string can cause GDAL to make server-side requests or read local files. The listed impact is limited to confidentiality.
Are unsupported Django releases known to be safe?
No. Unsupported series such as 5.1.x, 5.0.x, and 4.2.x were not evaluated and may also be affected.