CVE-2026-1207

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

Affected products

Django, Linuxmint, Red Os, Ubuntu

Djangoproject Django

< 4.2.28, 5.2.11, 6.0.2

Fix

Available

CVSS 3.1

8.3 HIGH

EPSS

13.0% (96th percentile)

Weakness

CWE-89

NVD status

Modified

Published

2026-02-03

Attack patterns

CAPEC-66

Entry point

band query param

Path

/book/search