CVE-2026-15307

High

Advisory

Published 4 Aug 2026In the index since 1 Oct 2026

Severity: High; worst across findings
CVSS: 8.8; base score, highest
EPSS: 0.011; 64th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 117; of 17,966 indexed, latest versions
Container images: 113; deployed by those charts
Fix available: 1 of 1; affected package

Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing

Carried by container images the latest versions of 117 of 17,966 indexed charts deploy, on 113 images.

Affected package	Affected versions	Fixed in	Images
djangopypi	1.11.11, 1.11.24, 1.11.29, 2.2.13+68 more	5.2.17, 6.0.8	113

OSV records: GHSA-wvqv-fj8w-qmhm
Also known as: BIT-django-2026-15307

Charts affected

117 by stars

Chart

Latest

Affected images

Radar Score

ddosifyanteon

1.7.5

3 of 13 See more

ddosify anteon 1.7.5

3 of the 13 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
ddosify/selfhosted_alaz_backend :1.0.6	a43c5155fa1c	django@4.2.11	5.2.17
ddosify/selfhosted_backend :2.6.11	ac323d52bfb4	django@4.1.13	5.2.17
ddosify/selfhosted_hammermanager :1.2.4	71b8768f49bc	django@3.2.24	5.2.17

Open the chart page →

27,220

argonix-apiargonix

0.5.6

1 of 4 See more

argonix-api argonix 0.5.6

1 of the 4 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
ghcr.io/argonix-io/argonix-api :0.5.6	dd18f26c9673	django@6.0.7	6.0.8

Open the chart page →

5,490

shynetatrox

0.1.1

1 of 1 See more

shynet atrox 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
milesmcc/shynet :v0.12.0	e821e31140f7	django@3.2.10	5.2.17

Open the chart page →

5,740

huebigdata-charts

1.0.4

1 of 2 See more

hue bigdata-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
gethue/hue :4.10.0	5702b2c37ff9	django@3.2.4	5.2.17

Open the chart page →

88,704

baserowblackbird-cloud

1.0.17

1 of 6 See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
baserow/backend :1.31.1	e0b3c8130b91	django@5.0.9	5.2.17

Open the chart page →

10,852

camerahubcamerahub

0.10.21

1 of 2 See more

camerahub camerahub 0.10.21

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
camerahub/camerahub :0.36.23	a5af37dd6e1b	django@3.2.18	5.2.17

Open the chart page →

2,595

opencvecfi2017

0.1.2

1 of 7 See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
ghcr.io/cfi2017/opencve-web :3.0.0	6961eab190a2	django@5.2.11	5.2.17

Open the chart page →

16,932

paperless-ngxcharts-derwitt-dev

2.1.5

1 of 1 See more

paperless-ngx charts-derwitt-dev 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :3.2.1	5fa76604a81d	django@5.2.16	5.2.17

Open the chart page →

4,533

cloudlaunchcloudve

0.6.0

1 of 5 See more

cloudlaunch cloudve 0.6.0

1 of the 5 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
cloudve/cloudlaunch-server :latest	4a3d7fae90bb	django@3.2.9	5.2.17

Open the chart page →

13,032

cloudlaunch-servercloudve

0.2.0

1 of 5 See more

cloudlaunch-server cloudve 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
cloudve/cloudlaunch-server :latest	4a3d7fae90bb	django@3.2.9	5.2.17

Open the chart page →

12,646

cloudlaunchservercloudve

0.6.0

1 of 4 See more

cloudlaunchserver cloudve 0.6.0

1 of the 4 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
cloudve/cloudlaunch-server :latest	4a3d7fae90bb	django@3.2.9	5.2.17

Open the chart page →

12,167

galaxykubemancloudve

2.10.1

1 of 7 See more

galaxykubeman cloudve 2.10.1

1 of the 7 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
galaxy/cloudman-server :latest	e5c265fe9fcd	django@4.0.7	5.2.17

Open the chart page →

16,723

authentikcluster-deploy

0.2.0

1 of 1 See more

authentik cluster-deploy 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
ghcr.io/goauthentik/server :2026.5.6	ed120caf710c	django@5.2.15	5.2.17

Open the chart page →

3,016

csghubcsghub

2.5.0

1 of 34 See more

csghub csghub 2.5.0

1 of the 34 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
opencsghq/label-studio :v2.5.0	47e22aa71870	django@5.1.15	5.2.17

Open the chart page →

53,831

csgshipcsghub

0.4.6

1 of 10 See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
opencsghq/csgship-web :v0.4.0	c36a5bac3cf0	django@5.0.3	5.2.17

Open the chart page →

12,932

dataflowcsghub

2.5.0

1 of 7 See more

dataflow csghub 2.5.0

1 of the 7 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
opencsghq/label-studio :v2.5.0	47e22aa71870	django@5.1.15	5.2.17

Open the chart page →

7,830

linkdingdeimosfr-charts

1.0.3

1 of 1 See more

linkding deimosfr-charts 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
sissbruecker/linkding :1.35.0	0c5dddf0b37c	django@5.1.1	5.2.17

Open the chart page →

6,553

seafilederp

3.2.0

1 of 1 See more

seafile derp 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
seafileltd/seafile-mc :10.0.1	70628f29c663	django@3.2.16	5.2.17

Open the chart page →

78,570

devops-diplomdevops-diplom-chart

0.8.0

1 of 2 See more

devops-diplom devops-diplom-chart 0.8.0

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
alexeyr7/sf-test-app :latest	df0b41fdbd53	django@4.0.5	5.2.17

Open the chart page →

2,627

adventurelogdjjudas21

0.1.1

1 of 3 See more

adventurelog djjudas21 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
ghcr.io/seanmorley15/adventurelog-backend :v0.13.0	0250d9cb0d74	django@5.2.13	5.2.17

Open the chart page →

8,224

codecovdouban

0.2.4

2 of 8 See more

codecov douban 0.2.4

2 of the 8 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
codecov/self-hosted-api :24.4.1	0475cb1c3136	django@4.2.7	5.2.17
codecov/self-hosted-worker :24.4.1	837f546b479b	django@4.2.11	5.2.17

Open the chart page →

26,156

seafileeleksbai

0.1.1

1 of 3 See more

seafile eleksbai 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
seafileltd/seafile-mc :9.0.10	6693911bcc40	django@3.2.14	5.2.17

Open the chart page →

94,115

escvmschedulerescvmscheduler

1.0.7

1 of 3 See more

escvmscheduler escvmscheduler 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
swisscomcloud/esc-vm-scheduler-web :latest	b6639d1a922e	django@3.2.16	5.2.17

Open the chart page →

5,200

business-api-ecosystemfiware

1.1.0

1 of 4 See more

business-api-ecosystem fiware 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
fiware/biz-ecosystem-charging-backend :11.7.0	29456835bb2c	django@3.2.8	5.2.17

Open the chart page →

117,372

tandoorgabe565

0.9.9

1 of 2 See more

tandoor gabe565 0.9.9

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
ghcr.io/tandoorrecipes/recipes :1.5.31	063eb446e298	django@4.2.18	5.2.17

Open the chart page →

2,398

babybuddygeek-cookbook

1.2.2

1 of 1 See more

babybuddy geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
linuxserver/babybuddy :1.10.2	f7d7c7704249	django@4.0.2	5.2.17

Open the chart page →

1,562

seafilegeek-cookbook

3.2.0

1 of 1 See more

seafile geek-cookbook 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
seafileltd/seafile-mc :8.0.7	ed0fcda5e6a9	django@2.2.14	5.2.17

Open the chart page →

102,703

weblatehelm-charts-nr

0.3.2

1 of 3 See more

weblate helm-charts-nr 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
weblate/weblate :4.2.2-1	69c160d37a3c	django@3.1.1	5.2.17

Open the chart page →

8,523

paperlesshomelabcihelmchartstest

9.1.9

1 of 1 See more

paperless homelabcihelmchartstest 9.1.9

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :2.0.1	ab255bea133e	django@4.2.7	5.2.17

Open the chart page →

17,357

paperlesshp

0.1.2

1 of 5 See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :3.1.3	aa810a36942c	django@5.2.16	5.2.17

Open the chart page →

30,498

erpnextimprowised

3.3.0

1 of 3 See more

erpnext improwised 3.3.0

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
improwised/erpnext-worker :v13.4.1	97280b55cbd4	django@1.11.29	5.2.17

Open the chart page →

7,098

healthchecksimprowised

1.1.1

1 of 2 See more

healthchecks improwised 1.1.1

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
linuxserver/healthchecks :2.7.20230331	94696dab3c50	django@4.1.7	5.2.17

Open the chart page →

2,696

label-studioinseefrlab

2.3.1

1 of 3 See more

label-studio inseefrlab 2.3.1

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
heartexlabs/label-studio :latest	aa461572e8f9	django@5.1.15	5.2.17

Open the chart page →

3,141

intelowlintelowl-helm

6.6.1-01-06-2026

1 of 5 See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
intelowlproject/intelowl :v6.6.1	0b22e547ea6b	django@4.2.27	5.2.17

Open the chart page →

19,848

inventreeinventree

0.4.30

1 of 2 See more

inventree inventree 0.4.30

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
inventree/inventree :1.5.6	b61e6a7534bf	django@5.2.16	5.2.17

Open the chart page →

5,820

ja-shortenerja-shortener

0.1.0

1 of 2 See more

ja-shortener ja-shortener 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
cr0hn/ja-shortener :v0.1.4	14482d0bc4a1	django@5.2.3	5.2.17

Open the chart page →

2,212

shynetjuniorjpdj

0.1.32

1 of 1 See more

shynet juniorjpdj 0.1.32

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
milesmcc/shynet :v0.13.1	ba54f7797a6b	django@4.1.10	5.2.17

Open the chart page →

2,814

paperlessk8s-home-lab-repo

11.0.1

1 of 1 See more

paperless k8s-home-lab-repo 11.0.1

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :2.20.14	b89f83345532	django@5.2.7	5.2.17

Open the chart page →

10,177

authentikkagiso-me

0.1.1

1 of 1 See more

authentik kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
ghcr.io/goauthentik/server :2026.2.1	46a71d75dfd3	django@5.2.11	5.2.17

Open the chart page →

5,138

huekatool

1.0.8

1 of 1 See more

85,445

aperagkubeblocks

0.0.0-nightly

1 of 3 See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	django@5.0.14	5.2.17

Open the chart page →

9,255

large-systems-djangolarge-systems-django

1.0.0

1 of 1 See more

large-systems-django large-systems-django 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
ha33ona/python :test	6affdfc644d0	django@2.2.26	5.2.17

Open the chart page →

4,596

linkdinglinkding

0.2.3

1 of 1 See more

linkding linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
sissbruecker/linkding :1.41.0-plus	a222fb777e1f	django@5.1.10	5.2.17

Open the chart page →

41,238

oncall-hobbylovemew67

0.0.5

1 of 2 See more

oncall-hobby lovemew67 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
grafana/oncall :v1.13.11	159b6b836fed	django@4.2.17	5.2.17

Open the chart page →

6,320

redisinsightlovemew67

0.0.1

1 of 1 See more

redisinsight lovemew67 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
redislabs/redisinsight :1.14.0	b03ab1426d0d	django@4.1.7	5.2.17

Open the chart page →

1,883

servicesmicroslac

0.4.0

4 of 8 See more

services microslac 0.4.0

4 of the 8 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
microslac/auth :latest	5c1eb1f5c64d	django@5.0.2	5.2.17
microslac/conversations :latest	1b24afcd71ff	django@5.0.2	5.2.17
microslac/teams :latest	0f75997fcbe5	django@5.0.2	5.2.17
microslac/users :latest	216ea6832a56	django@5.0.2	5.2.17

Open the chart page →

33,576

paperless-ngxmt190502

7.6.14

1 of 4 See more

paperless-ngx mt190502 7.6.14

1 of the 4 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :2.20.13	4b05bcd28e69	django@5.2.7	5.2.17

Open the chart page →

12,979

babybuddynicholaswilde

2.3.0

1 of 1 See more

babybuddy nicholaswilde 2.3.0

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/babybuddy :version-v1.9.0	841d90cf8e72	django@3.2.7	5.2.17

Open the chart page →

1,932

paperless-ngxoli-the-dev

1.1.1

1 of 1 See more

paperless-ngx oli-the-dev 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :3.1.3	aa810a36942c	django@5.2.16	5.2.17

Open the chart page →

5,464

comacopencord

1.0.0

2 of 9 See more

comac opencord 1.0.0

2 of the 9 container images this version deploys carry CVE-2026-15307.

Container image	Digest	Package	Fixed in
omecproject/mcord-synchronizer :comac-1.0.0	cfdb566dd949	django@1.11.11	5.2.17
omecproject/progran-synchronizer :comac-1.0.0	d109a8e57e71	django@1.11.11	5.2.17

Open the chart page →

264,687

Container images carrying it

113 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
linuxserver/babybuddy :1.10.2	f7d7c7704249	django@4.0.2	5.2.17	1
linuxserver/healthchecks :version-v1.20.0	50792a72fc71	django@3.2	5.2.17	1
linuxserver/healthchecks :2.7.20230331	94696dab3c50	django@4.1.7	5.2.17	1
makeplane/backend-commercial :v3.3.0	f587597c46b5	django@5.2.16	5.2.17	1
mathesar/mathesar :0.12.0	091757cb01fe	django@4.2.29	5.2.17	1
microslac/auth :latest	5c1eb1f5c64d	django@5.0.2	5.2.17	1
microslac/conversations :latest	1b24afcd71ff	django@5.0.2	5.2.17	1
microslac/teams :latest	0f75997fcbe5	django@5.0.2	5.2.17	1
microslac/users :latest	216ea6832a56	django@5.0.2	5.2.17	1
milesmcc/shynet :v0.13.1	ba54f7797a6b	django@4.1.10	5.2.17	1
milesmcc/shynet :v0.12.0	e821e31140f7	django@3.2.10	5.2.17	1
mvitale1989/docker-taiga :20191031-4.2.14	1504ccda06df	django@1.11.24	5.2.17	1
netboxcommunity/netbox :v3.2.8	3d652dca5351	django@4.0.7	5.2.17	1
netboxcommunity/netbox :v3.7.8-2.8.0	9bf83b350a89	django@4.2.11	5.2.17	1
networktocode/nautobot :3.0-py3.13	ed484336b1ad	django@4.2.30	5.2.17	1
omecproject/progran-synchronizer :comac-1.0.0	d109a8e57e71	django@1.11.11	5.2.17	1
opencsghq/csgship-web :v0.4.0	c36a5bac3cf0	django@5.0.3	5.2.17	1
opennode/waldur-mastermind :8.1.2	4c82b15d9042	django@6.0.7	6.0.8	1
openzaak/open-notificaties :1.3.0	2e65313b9b10	django@3.2.12	5.2.17	1
openzaak/open-zaak :1.6.0	2ca2ea6e0ae9	django@3.2.12	5.2.17	1
pretix/standalone :2026.7.0	5df3b7aa852e	django@5.2.16	5.2.17	1
prowlercloud/prowler-api :5.31.1	4f252d579be2	django@5.1.15	5.2.17	1
psono/psono-server :5.0.0	3b974b43ea03	django@4.2.16	5.2.17	1
recordsansible/ara-api :latest	9dfd6e18f474	django@5.2.16	5.2.17	1
seafileltd/seafile-mc :9.0.10	6693911bcc40	django@3.2.14	5.2.17	1
seafileltd/seafile-mc :10.0.1	70628f29c663	django@3.2.16	5.2.17	1
seafileltd/seafile-mc :9.0.9	7ac833196f60	django@3.2.14	5.2.17	1
seafileltd/seafile-mc :8.0.7	ed0fcda5e6a9	django@2.2.14	5.2.17	1
signalen/backend :2.50.18	26bb090bc4e4	django@4.2.30	5.2.17	1
sissbruecker/linkding :1.35.0	0c5dddf0b37c	django@5.1.1	5.2.17	1
sissbruecker/linkding :1.41.0-plus	a222fb777e1f	django@5.1.10	5.2.17	1
sissbruecker/linkding :1.47.0	e35cb50e0581	django@6.0.7	6.0.8	1
swisscomcloud/esc-vm-scheduler-web :latest	b6639d1a922e	django@3.2.16	5.2.17	1
taigaio/taiga-back :6.4.2	9f97323cc150	django@2.2.24	5.2.17	1
vabene1111/recipes :2.3.5	0f8d061895e9	django@5.2.8	5.2.17	1
vabene1111/recipes :1.0.5.2	ec4e9e2905b0	django@3.2.11	5.2.17	1
weblate/weblate :3.11.3-1	82848df56ecd	django@3.0.4	5.2.17	1
ghcr.io/argonix-io/argonix-api :0.5.6	dd18f26c9673	django@6.0.7	6.0.8	1
ghcr.io/cfi2017/opencve-web :3.0.0	6961eab190a2	django@5.2.11	5.2.17	1
ghcr.io/gabe565/obico/web :latest	122456be28c9	django@4.0.10	5.2.17	1
ghcr.io/getsentry/sentry :26.7.2	7c5052aa4e3c	django@5.2.14	5.2.17	1
ghcr.io/goauthentik/server :2026.2.1	46a71d75dfd3	django@5.2.11	5.2.17	1
ghcr.io/goauthentik/server :2026.5.6	ed120caf710c	django@5.2.15	5.2.17	1
ghcr.io/libretime/libretime-api :latest	eae026cc8909	django@4.2.23	5.2.17	1
ghcr.io/linuxserver/babybuddy :version-v1.9.0	841d90cf8e72	django@3.2.7	5.2.17	1
ghcr.io/linuxserver/healthchecks :version-v3.9	b5c6bfb00b03	django@5.1.4	5.2.17	1
ghcr.io/linuxserver/papermerge :version-v2.0.1	98ba2dd3f0bd	django@3.1.8	5.2.17	1
ghcr.io/mirio/verbacap :v1.5.0	84928e2fc4f2	django@5.0.4	5.2.17	1
ghcr.io/paperless-ngx/paperless-ngx :2.13.1	0642357c5dbd	django@5.1.1	5.2.17	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.13	4b05bcd28e69	django@5.2.7	5.2.17	1