Bug 2564008 (CVE-2026-114582)

Summary: CVE-2026-114582 django: Server-side request forgery via `SpatialReference` string input
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: anthomas, brasmith, cmyers, cochase, dnakabaa, dranck, dschmidt, eglynn, ehelms, ggainey, jjoyce, jlanda, jmitchel, jpasqual, jpretori, jschluet, juwatts, jwong, kaycoth, kshier, lblicha, lbrazdil, lcouzens, lhh, mburns, mdellweg, mgarciac, mhulan, mminar, nmoumoul, ogajduse, omaciel, osousa, pcreech, rbiba, rbobbitt, rchan, security-response-team, simaishi, smallamp, sskracic, stcannon, tguha, tmalecek, tpfromme, ttakamiy, yguenane, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Django. When handling spatial reference strings, input is passed directly to the underlying Geospatial Data Abstraction Library (GDAL), which by default resolves network addresses and accesses files on the host system. A remote attacker can exploit this flaw by providing a crafted URL or file path, leading to Server-Side Request Forgery (SSRF) and unauthorized local file disclosure.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-11-03   

Description OSIDB Bzimport 2026-10-30 13:28:34 UTC 
CVE-2026-114582: Server-side request forgery via `SpatialReference` string input

`SpatialReference` passed string input to GDAL,

which by default resolves URLs and reads files. This behavior was not
documented by Django. Other affected methods included
`GEOSGeometry.transform()`, `OGRGeometry.transform()`, `GDALRaster.transform()`,
the `srs` setter of `OGRGeometry`, and the `srs` and `srid` setters of `GDALRaster`.
A URL or file path reaching any of these would issue an outbound request or
read a file as the Django process user. The attack vectors could be combined to
reveal local file contents by observing outbound requests.

`SpatialReference` now disables network and file access when parsing string
input on GDAL 3.9 and later. As a consequence, file paths and URLs are no
longer accepted as `SpatialReference` inputs. Dictionary references using the
`DICT:` prefix, including those prefixed with `ESRI::`, are rejected on all
GDAL versions.

Full protection requires GDAL 3.9 or later. Integer SRIDs are looked up
directly in the EPSG database, so prefer them when the input is untrusted. Or,
if strings must be used on lower GDAL versions, compare to an allow list. The
new `gis.W001` system check warns when the installed version of GDAL is not
at least 3.9.

This issue has severity "low" according to the [Django security policy](https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels).

Thanks adraca for the report.