CVE-2026-93456: django-page-cms through 2.0.13 CSRF via admin mutation views
django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
django-page-cmsto a version that resolves this vulnerability.Fixed in 2.0.13 - Configuration
Remove CSRF exemptions for the five admin mutation views in pages/admin/views.py so attackers cannot forge requests to modify page content.
django-page-cms (pages/admin/views.py) CSRF protection for admin mutation views = enabled for all admin mutation views
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Organizations using django-page-cms through version 2.0.13 are exposed when a signed-in editor can be induced to visit an attacker-controlled malicious page. The attacker does not need credentials, but relies on the editor's authenticated browser session.
What is the likely impact of a successful attack?
An attacker can forge a request that modifies page content and stores unescaped content. That content can render for all site visitors, creating a stored cross-site scripting risk.
Which functionality is affected?
Five admin mutation views in pages/admin/views.py are exempt from CSRF protection. The affected operations are administrative page-content modifications handled by those views.