CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
Raster lookups on RasterField (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Tarek Nakkouch for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 4.2.28 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 5.2.11 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 6.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1207?
CVE-2026-1207 is considered a critical vulnerability due to the potential for SQL injection attacks.
How do I fix CVE-2026-1207?
To fix CVE-2026-1207, upgrade Django to version 4.2.28, 5.2.11, or 6.0.2, depending on your current version.
What versions of Django are affected by CVE-2026-1207?
Django versions prior to 6.0.2, 5.2.11, and 4.2.28 are affected by CVE-2026-1207.
What type of attacks does CVE-2026-1207 enable?
CVE-2026-1207 allows remote attackers to perform SQL injection via raster lookups on the RasterField.
Is there a known exploit for CVE-2026-1207?
Yes, there are indications that CVE-2026-1207 can be exploited to perform SQL injection attacks, compromising database security.