StackRadar

CVE-2026-15307

High

Advisory

Published 4 Aug 2026In the index since 1 Oct 2026
Severity
High
worst across findings
CVSS
8.8
base score, highest
EPSS
0.011
64th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
117
of 17,966 indexed, latest versions
Container images
113
deployed by those charts
Fix available
1 of 1
affected package

Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing

Carried by container images the latest versions of 117 of 17,966 indexed charts deploy, on 113 images.

Affected packageAffected versionsFixed inImages
djangopypi1.11.11, 1.11.24, 1.11.29, 2.2.13+68 more5.2.17, 6.0.8113
OSV records
GHSA-wvqv-fj8w-qmhm
Also known as
BIT-django-2026-15307

Charts affected

117 by stars
ChartLatestAffected imagesRadar Score
netboxbootcVerified publisher4.1.11 of 4See more

netbox bootc 4.1.1

1 of the 4 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.2.83d652dca5351
django@4.0.7
5.2.17

Open the chart page →

9,712
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
grafana/oncall:v1.16.5499851658393
django@4.2.22
5.2.17

Open the chart page →

16,873
paperless-ngxfmjstudios0.2.81 of 5See more

paperless-ngx fmjstudios 0.2.8

1 of the 5 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.10.1a132c2ac7c57
django@4.2.13
5.2.17

Open the chart page →

32,948
nautobotnautobotOfficialVerified publisher3.1.21 of 1See more

nautobot nautobot 3.1.2

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
networktocode/nautobot:3.0-py3.13ed484336b1ad
django@4.2.30
5.2.17

Open the chart page →

5,094
netris-controllernetrisai2.8.21 of 14See more

netris-controller netrisai 2.8.2

1 of the 14 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
django@2.2.13
5.2.17

Open the chart page →

31,460
paperless-ngxpaperless-ngxVerified publisher0.3.231 of 3See more

paperless-ngx paperless-ngx 0.3.23

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.2.15fa76604a81d
django@5.2.16
5.2.17

Open the chart page →

8,612
baserowbaserow-chartVerified publisher1.0.561 of 6See more

baserow baserow-chart 1.0.56

1 of the 6 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
baserow/backend:2.3.37c00549b3a6f
django@5.2.15
5.2.17

Open the chart page →

19,214
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
datamate/seafile-professional:11.0.202dd66b722464
django@4.2.23
5.2.17

Open the chart page →

82,487
taigarc-helm-charts0.1.01 of 7See more

taiga rc-helm-charts 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
taigaio/taiga-back:6.4.29f97323cc150
django@2.2.24
5.2.17

Open the chart page →

7,481
netboxstartechnicaVerified publisher5.1.01 of 4See more

netbox startechnica 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
django@4.2.11
5.2.17

Open the chart page →

1,854
convertigoconvertigoOfficialVerified publisher8.4.51 of 5See more

convertigo convertigo 8.4.5

1 of the 5 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
django@5.0.9
5.2.17

Open the chart page →

16,268
defectdojodefectdojo1.9.541 of 4See more

defectdojo defectdojo 1.9.54

1 of the 4 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
defectdojo/defectdojo-django:3.3.3006516f0f62086
django@5.2.16
5.2.17

Open the chart page →

2,171
openshift-secured-redisInsighteximiaitVerified publisher0.9.21 of 2See more

openshift-secured-redisInsight eximiait 0.9.2

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
redislabs/redisinsight:1.14.0b03ab1426d0d
django@4.1.7
5.2.17

Open the chart page →

14,126
healthchecksgabe565Verified publisher0.17.01 of 1See more

healthchecks gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/healthchecks:version-v3.9b5c6bfb00b03
django@5.1.4
5.2.17

Open the chart page →

2,647
flagsmithone-acre-fundVerified publisher0.1.51 of 6See more

flagsmith one-acre-fund 0.1.5

1 of the 6 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
flagsmith/flagsmith-api:v2.6.0fd58556339a4
django@2.2.17
5.2.17

Open the chart page →

7,060
kobotoolboxone-acre-fundVerified publisher0.7.42 of 9See more

kobotoolbox one-acre-fund 0.7.4

2 of the 9 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
kobotoolbox/kobocat:2.022.24ab15679454415
django@2.2.28
5.2.17
kobotoolbox/kpi:2.022.24dbcacc01bccd4
django@2.2.27
5.2.17

Open the chart page →

20,085
open-zaakopen-zaak0.8.01 of 3See more

open-zaak open-zaak 0.8.0

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
openzaak/open-zaak:1.6.02ca2ea6e0ae9
django@3.2.12
5.2.17

Open the chart page →

4,680
pretixtechwolf12Verified publisher2026.7.01 of 3See more

pretix techwolf12 2026.7.0

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
pretix/standalone:2026.7.05df3b7aa852e
django@5.2.16
5.2.17

Open the chart page →

11,305
paperlesszekker6Verified publisher11.10.01 of 1See more

paperless zekker6 11.10.0

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.2.15fa76604a81d
django@5.2.16
5.2.17

Open the chart page →

4,533
paperless-ngxadnoctemVerified publisher0.4.21 of 5See more

paperless-ngx adnoctem 0.4.2

1 of the 5 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
django@5.2.16
5.2.17

Open the chart page →

23,678
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
django@5.2.7
5.2.17

Open the chart page →

13,459
psonoankra-chartsVerified publisher1.2.01 of 2See more

psono ankra-charts 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
psono/psono-server:5.0.03b974b43ea03
django@4.2.16
5.2.17

Open the chart page →

2,539
anteonanteonVerified publisher2.6.43 of 13See more

anteon anteon 2.6.4

3 of the 13 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:2.3.11e5be48b37348
django@5.0.7
5.2.17
ddosify/selfhosted_backend:3.2.93c11e3182652
django@4.1.13
5.2.17
ddosify/selfhosted_hammermanager:2.0.2b796b8c73011
django@4.1.13
5.2.17

Open the chart page →

23,690
squestchristianhuthVerified publisher6.6.81 of 4See more

squest christianhuth 6.6.8

1 of the 4 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
django@4.2.21
5.2.17

Open the chart page →

11,073
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
django@5.1.1
5.2.17

Open the chart page →

14,832
weblatedeliveryheroVerified publisher0.3.21 of 3See more

weblate deliveryhero 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
weblate/weblate:4.2.2-169c160d37a3c
django@3.1.1
5.2.17

Open the chart page →

8,523
archerydoubanVerified publisher0.4.31 of 6See more

archery douban 0.4.3

1 of the 6 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
hhyo/archery:v1.9.11aa41843419e
django@4.1.1
5.2.17

Open the chart page →

6,093
seafiledr300481Verified publisher0.12.11 of 1See more

seafile dr300481 0.12.1

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:11.0.12d0c66e4621bd
django@4.2.15
5.2.17

Open the chart page →

77,112
taigafermosit0.0.111 of 7See more

taiga fermosit 0.0.11

1 of the 7 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
taigaio/taiga-back:latest4beed8f62c9f
django@3.2.25
5.2.17

Open the chart page →

9,285
obicogabe565Verified publisher0.6.01 of 3See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/gabe565/obico/web:latest122456be28c9
django@4.0.10
5.2.17

Open the chart page →

2,227
healthchecksgeek-cookbookVerified publisher4.4.21 of 1See more

healthchecks geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
linuxserver/healthchecks:version-v1.20.050792a72fc71
django@3.2
5.2.17

Open the chart page →

1,718
paperlessgeek-cookbookVerified publisher9.2.01 of 1See more

paperless geek-cookbook 9.2.0

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:1.8.09bbc9a90641e
django@4.0.6
5.2.17

Open the chart page →

4,056
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
django@3.2.11
5.2.17

Open the chart page →

8,118
huehue1.0.31 of 3See more

hue hue 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
gethue/hue:latest7d5c1b9f8a79
django@4.2.23
5.2.17

Open the chart page →

67,758
aralib42Verified publisher0.4.61 of 1See more

ara lib42 0.4.6

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
recordsansible/ara-api:latest9dfd6e18f474
django@5.2.16
5.2.17

Open the chart page →

177
plane-enterprisemakeplaneOfficialVerified publisher3.10.21 of 13See more

plane-enterprise makeplane 3.10.2

1 of the 13 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
makeplane/backend-commercial:v3.3.0f587597c46b5
django@5.2.16
5.2.17

Open the chart page →

4,608
helm-taigamvitale1989-helm-taigaVerified publisher0.2.51 of 2See more

helm-taiga mvitale1989-helm-taiga 0.2.5

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
mvitale1989/docker-taiga:20191031-4.2.141504ccda06df
django@1.11.24
5.2.17

Open the chart page →

5,455
papermergenicholaswildeVerified publisher1.0.21 of 1See more

papermerge nicholaswilde 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/papermerge:version-v2.0.198ba2dd3f0bd
django@3.1.8
5.2.17

Open the chart page →

20,968
openvaultopenvaultVerified publisher0.9.01 of 2See more

openvault openvault 0.9.0

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
django@5.2.3
5.2.17

Open the chart page →

7,470
open-notificatiesopen-zaak0.7.01 of 4See more

open-notificaties open-zaak 0.7.0

1 of the 4 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
openzaak/open-notificaties:1.3.02e65313b9b10
django@3.2.12
5.2.17

Open the chart page →

2,992
paperless-ngxpaperlessVerified publisher0.4.01 of 3See more

paperless-ngx paperless 0.4.0

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngxdigest-pinnedaa810a36942c
django@5.2.16
5.2.17

Open the chart page →

9,844
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
django@5.1.15
5.2.17

Open the chart page →

9,505
sentry-k8ssentry-k8sVerified publisher1.4.11 of 11See more

sentry-k8s sentry-k8s 1.4.1

1 of the 11 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
django@5.2.14
5.2.17

Open the chart page →

18,612
healthchecksstackhelmVerified publisher0.1.01 of 2See more

healthchecks stackhelm 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
healthchecks/healthchecks:v2.8.1e82bb0836e30
django@4.2
5.2.17

Open the chart page →

2,308
taigaunxwaresVerified publisher2026.3.81 of 6See more

taiga unxwares 2026.3.8

1 of the 6 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
taigaio/taiga-back:latest4beed8f62c9f
django@3.2.25
5.2.17

Open the chart page →

9,939
verbacapverbacapVerified publisher1.0.71 of 1See more

verbacap verbacap 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/mirio/verbacap:v1.5.084928e2fc4f2
django@5.0.4
5.2.17

Open the chart page →

2,437
waldurwaldur-chartsVerified publisher8.1.21 of 3See more

waldur waldur-charts 8.1.2

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
opennode/waldur-mastermind:8.1.24c82b15d9042
django@6.0.7
6.0.8

Open the chart page →

5,429
qleverzazukoVerified publisher0.7.11 of 2See more

qlever zazuko 0.7.1

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/zazukoians/qlever-ui:v0.10.151a7ec1c2de4
django@5.2.12
5.2.17

Open the chart page →

2,906
tubearchivistalexmorbo-tubearchivistVerified publisher0.1.01 of 2See more

tubearchivist alexmorbo-tubearchivist 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
bbilly1/tubearchivist:v0.5.9b827a713f55b
django@5.2.11
5.2.17

Open the chart page →

5,859
mathesarandrenarchyVerified publisher1.8.01 of 1See more

mathesar andrenarchy 1.8.0

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
mathesar/mathesar:0.12.0091757cb01fe
django@4.2.29
5.2.17

Open the chart page →

8,115

Container images carrying it

113 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
django@5.2.16
5.2.17
4
cloudve/cloudlaunch-server:latest4a3d7fae90bb
django@3.2.9
5.2.17
3
ghcr.io/paperless-ngx/paperless-ngx:3.2.15fa76604a81d
django@5.2.16
5.2.17
3
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
django@1.11.11
5.2.17
2
opencsghq/label-studio:v2.5.047e22aa71870
django@5.1.15
5.2.17
2
redislabs/redisinsight:1.14.0b03ab1426d0d
django@4.1.7
5.2.17
2
safeglobal/safe-config-service:latest09a5e495c219
django@6.0.5
6.0.8
2
safeglobal/safe-transaction-service:latest7b576c73f865
django@5.2.16
5.2.17
2
seafileltd/seafile-mc:11.0.12d0c66e4621bd
django@4.2.15
5.2.17
2
taigaio/taiga-back:latest4beed8f62c9f
django@3.2.25
5.2.17
2
weblate/weblate:4.2.2-169c160d37a3c
django@3.1.1
5.2.17
2
alexeyr7/sf-test-app:latestdf0b41fdbd53
django@4.0.5
5.2.17
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
django@5.0.14
5.2.17
1
baserow/backend:2.3.37c00549b3a6f
django@5.2.15
5.2.17
1
baserow/backend:1.31.1e0b3c8130b91
django@5.0.9
5.2.17
1
baserow/baserow:1.30.1df0c42eb67e8
django@5.0.9
5.2.17
1
bbilly1/tubearchivist:v0.5.9b827a713f55b
django@5.2.11
5.2.17
1
beanbag/reviewboard:latest6b840f546e1c
django@4.2.30
5.2.17
1
camerahub/camerahub:0.36.23a5af37dd6e1b
django@3.2.18
5.2.17
1
codecov/self-hosted-api:24.4.10475cb1c3136
django@4.2.7
5.2.17
1
codecov/self-hosted-worker:24.4.1837f546b479b
django@4.2.11
5.2.17
1
cr0hn/ja-shortener:v0.1.414482d0bc4a1
django@5.2.3
5.2.17
1
datamate/seafile-professional:11.0.202dd66b722464
django@4.2.23
5.2.17
1
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
django@4.2.11
5.2.17
1
ddosify/selfhosted_alaz_backend:2.3.11e5be48b37348
django@5.0.7
5.2.17
1
ddosify/selfhosted_backend:3.2.93c11e3182652
django@4.1.13
5.2.17
1
ddosify/selfhosted_backend:2.6.11ac323d52bfb4
django@4.1.13
5.2.17
1
ddosify/selfhosted_hammermanager:1.2.471b8768f49bc
django@3.2.24
5.2.17
1
ddosify/selfhosted_hammermanager:2.0.2b796b8c73011
django@4.1.13
5.2.17
1
defectdojo/defectdojo-django:3.3.3006516f0f62086
django@5.2.16
5.2.17
1
dellnoantechnp/dingtalk-bot:v1.0.1034000bbcad5
django@5.2.9
5.2.17
1
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
django@3.2.8
5.2.17
1
flagsmith/flagsmith-api:v2.6.0fd58556339a4
django@2.2.17
5.2.17
1
galaxy/cloudman-server:lateste5c265fe9fcd
django@4.0.7
5.2.17
1
gethue/hue:4.11.011b649636e68
django@3.2.16
5.2.17
1
gethue/hue:4.10.05702b2c37ff9
django@3.2.4
5.2.17
1
gethue/hue:latest7d5c1b9f8a79
django@4.2.23
5.2.17
1
grafana/oncall:v1.13.11159b6b836fed
django@4.2.17
5.2.17
1
grafana/oncall:v1.16.5499851658393
django@4.2.22
5.2.17
1
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
django@2.2.13
5.2.17
1
ha33ona/python:test6affdfc644d0
django@2.2.26
5.2.17
1
healthchecks/healthchecks:v2.8.1e82bb0836e30
django@4.2
5.2.17
1
heartexlabs/label-studio:latestaa461572e8f9
django@5.1.15
5.2.17
1
hhyo/archery:v1.9.11aa41843419e
django@4.1.1
5.2.17
1
improwised/erpnext-worker:v13.4.197280b55cbd4
django@1.11.29
5.2.17
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
django@4.2.27
5.2.17
1
inventree/inventree:1.5.6b61e6a7534bf
django@5.2.16
5.2.17
1
kobotoolbox/kobocat:2.022.24ab15679454415
django@2.2.28
5.2.17
1
kobotoolbox/kpi:2.022.24dbcacc01bccd4
django@2.2.27
5.2.17
1
kporwit/vinyl_lib_app:v0.1.1217de0302218
django@4.0.5
5.2.17
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.