StackRadar

CVE-2026-15307

High

Advisory

Published 4 Aug 2026In the index since 1 Oct 2026
Severity
High
worst across findings
CVSS
8.8
base score, highest
EPSS
0.011
64th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
117
of 17,966 indexed, latest versions
Container images
113
deployed by those charts
Fix available
1 of 1
affected package

Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing

Carried by container images the latest versions of 117 of 17,966 indexed charts deploy, on 113 images.

Affected packageAffected versionsFixed inImages
djangopypi1.11.11, 1.11.24, 1.11.29, 2.2.13+68 more5.2.17, 6.0.8113
OSV records
GHSA-wvqv-fj8w-qmhm
Also known as
BIT-django-2026-15307

Charts affected

117 by stars
ChartLatestAffected imagesRadar Score
comac-platformopencord0.0.171 of 11See more

comac-platform opencord 0.0.17

1 of the 11 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
django@1.11.11
5.2.17

Open the chart page →

84,245
linkdingpascaliskeVerified publisher3.0.01 of 1See more

linkding pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/sissbruecker/linkding:1.45.061b2eb9eed8e
django@6.0
6.0.8

Open the chart page →

4,305
seafilephybros-helm-charts4.0.11 of 1See more

seafile phybros-helm-charts 4.0.1

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:9.0.97ac833196f60
django@3.2.14
5.2.17

Open the chart page →

94,375
libretimepodzone-chartsVerified publisher0.4.11 of 9See more

libretime podzone-charts 0.4.1

1 of the 9 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/libretime/libretime-api:latesteae026cc8909
django@4.2.23
5.2.17

Open the chart page →

12,041
reviewboardrock8sVerified publisher0.0.11 of 3See more

reviewboard rock8s 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
beanbag/reviewboard:latest6b840f546e1c
django@4.2.30
5.2.17

Open the chart page →

6,389
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
django@5.2.7
5.2.17

Open the chart page →

11,750
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
django@5.2.8
5.2.17

Open the chart page →

4,795
linkdingrubxkubeVerified publisher1.2.41 of 1See more

linkding rubxkube 1.2.4

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
sissbruecker/linkding:1.47.0e35cb50e0581
django@6.0.7
6.0.8

Open the chart page →

2,460
safe-config-servicesafe-global0.1.01 of 3See more

safe-config-service safe-global 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
django@6.0.5
6.0.8

Open the chart page →

1,926
safe-stacksafe-global0.1.02 of 9See more

safe-stack safe-global 0.1.0

2 of the 9 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
django@6.0.5
6.0.8
safeglobal/safe-transaction-service:latest7b576c73f865
django@5.2.16
5.2.17

Open the chart page →

20,611
safe-transaction-servicesafe-global0.1.01 of 6See more

safe-transaction-service safe-global 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
safeglobal/safe-transaction-service:latest7b576c73f865
django@5.2.16
5.2.17

Open the chart page →

17,188
seafileseafileVerified publisher0.12.11 of 1See more

seafile seafile 0.12.1

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:11.0.12d0c66e4621bd
django@4.2.15
5.2.17

Open the chart page →

77,112
backendsignalen4.25.01 of 4See more

backend signalen 4.25.0

1 of the 4 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
signalen/backend:2.50.1826bb090bc4e4
django@4.2.30
5.2.17

Open the chart page →

11,735
weblateslamdev0.0.111 of 2See more

weblate slamdev 0.0.11

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
weblate/weblate:3.11.3-182848df56ecd
django@3.0.4
5.2.17

Open the chart page →

9,257
substra-backendsubstraVerified publisher26.15.31 of 7See more

substra-backend substra 26.15.3

1 of the 7 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/substra/substra-backend:1.0.121967f54ec86
django@4.2.16
5.2.17

Open the chart page →

4,938
vinyl-lib-chartvinyl-libVerified publisher0.1.01 of 1See more

vinyl-lib-chart vinyl-lib 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
kporwit/vinyl_lib_app:v0.1.1217de0302218
django@4.0.5
5.2.17

Open the chart page →

3,934
dingtalk-botxxl-job-adminVerified publisher0.1.31 of 2See more

dingtalk-bot xxl-job-admin 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
dellnoantechnp/dingtalk-bot:v1.0.1034000bbcad5
django@5.2.9
5.2.17

Open the chart page →

3,565

Container images carrying it

113 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
linuxserver/babybuddy:1.10.2f7d7c7704249
django@4.0.2
5.2.17
1
linuxserver/healthchecks:version-v1.20.050792a72fc71
django@3.2
5.2.17
1
linuxserver/healthchecks:2.7.2023033194696dab3c50
django@4.1.7
5.2.17
1
makeplane/backend-commercial:v3.3.0f587597c46b5
django@5.2.16
5.2.17
1
mathesar/mathesar:0.12.0091757cb01fe
django@4.2.29
5.2.17
1
microslac/auth:latest5c1eb1f5c64d
django@5.0.2
5.2.17
1
microslac/conversations:latest1b24afcd71ff
django@5.0.2
5.2.17
1
microslac/teams:latest0f75997fcbe5
django@5.0.2
5.2.17
1
microslac/users:latest216ea6832a56
django@5.0.2
5.2.17
1
milesmcc/shynet:v0.13.1ba54f7797a6b
django@4.1.10
5.2.17
1
milesmcc/shynet:v0.12.0e821e31140f7
django@3.2.10
5.2.17
1
mvitale1989/docker-taiga:20191031-4.2.141504ccda06df
django@1.11.24
5.2.17
1
netboxcommunity/netbox:v3.2.83d652dca5351
django@4.0.7
5.2.17
1
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
django@4.2.11
5.2.17
1
networktocode/nautobot:3.0-py3.13ed484336b1ad
django@4.2.30
5.2.17
1
omecproject/progran-synchronizer:comac-1.0.0d109a8e57e71
django@1.11.11
5.2.17
1
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
django@5.0.3
5.2.17
1
opennode/waldur-mastermind:8.1.24c82b15d9042
django@6.0.7
6.0.8
1
openzaak/open-notificaties:1.3.02e65313b9b10
django@3.2.12
5.2.17
1
openzaak/open-zaak:1.6.02ca2ea6e0ae9
django@3.2.12
5.2.17
1
pretix/standalone:2026.7.05df3b7aa852e
django@5.2.16
5.2.17
1
prowlercloud/prowler-api:5.31.14f252d579be2
django@5.1.15
5.2.17
1
psono/psono-server:5.0.03b974b43ea03
django@4.2.16
5.2.17
1
recordsansible/ara-api:latest9dfd6e18f474
django@5.2.16
5.2.17
1
seafileltd/seafile-mc:9.0.106693911bcc40
django@3.2.14
5.2.17
1
seafileltd/seafile-mc:10.0.170628f29c663
django@3.2.16
5.2.17
1
seafileltd/seafile-mc:9.0.97ac833196f60
django@3.2.14
5.2.17
1
seafileltd/seafile-mc:8.0.7ed0fcda5e6a9
django@2.2.14
5.2.17
1
signalen/backend:2.50.1826bb090bc4e4
django@4.2.30
5.2.17
1
sissbruecker/linkding:1.35.00c5dddf0b37c
django@5.1.1
5.2.17
1
sissbruecker/linkding:1.41.0-plusa222fb777e1f
django@5.1.10
5.2.17
1
sissbruecker/linkding:1.47.0e35cb50e0581
django@6.0.7
6.0.8
1
swisscomcloud/esc-vm-scheduler-web:latestb6639d1a922e
django@3.2.16
5.2.17
1
taigaio/taiga-back:6.4.29f97323cc150
django@2.2.24
5.2.17
1
vabene1111/recipes:2.3.50f8d061895e9
django@5.2.8
5.2.17
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
django@3.2.11
5.2.17
1
weblate/weblate:3.11.3-182848df56ecd
django@3.0.4
5.2.17
1
ghcr.io/argonix-io/argonix-api:0.5.6dd18f26c9673
django@6.0.7
6.0.8
1
ghcr.io/cfi2017/opencve-web:3.0.06961eab190a2
django@5.2.11
5.2.17
1
ghcr.io/gabe565/obico/web:latest122456be28c9
django@4.0.10
5.2.17
1
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
django@5.2.14
5.2.17
1
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
django@5.2.11
5.2.17
1
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
django@5.2.15
5.2.17
1
ghcr.io/libretime/libretime-api:latesteae026cc8909
django@4.2.23
5.2.17
1
ghcr.io/linuxserver/babybuddy:version-v1.9.0841d90cf8e72
django@3.2.7
5.2.17
1
ghcr.io/linuxserver/healthchecks:version-v3.9b5c6bfb00b03
django@5.1.4
5.2.17
1
ghcr.io/linuxserver/papermerge:version-v2.0.198ba2dd3f0bd
django@3.1.8
5.2.17
1
ghcr.io/mirio/verbacap:v1.5.084928e2fc4f2
django@5.0.4
5.2.17
1
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
django@5.1.1
5.2.17
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
django@5.2.7
5.2.17
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.