Vulnerabilities CVE-2026-1207

CVE-2026-1207

None

Open

TLP:CLEAR

Potential SQL injection via raster lookups on PostGIS

NVD CVE.org

Critical Infrastructure

AI Analysis

No AI analysis yet.

Description

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

Details

EPSS Score ⓘ: 12.98%

96th percentile
Confidence: 90%
Published: Feb 3, 2026
Last Modified: Jul 15, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.