StackRadar

CVE-2026-15307

High

Advisory

Published 4 Aug 2026In the index since 1 Oct 2026
Severity
High
worst across findings
CVSS
8.8
base score, highest
EPSS
0.011
64th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
117
of 17,966 indexed, latest versions
Container images
113
deployed by those charts
Fix available
1 of 1
affected package

Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing

Carried by container images the latest versions of 117 of 17,966 indexed charts deploy, on 113 images.

Affected packageAffected versionsFixed inImages
djangopypi1.11.11, 1.11.24, 1.11.29, 2.2.13+68 more5.2.17, 6.0.8113
OSV records
GHSA-wvqv-fj8w-qmhm
Also known as
BIT-django-2026-15307

Charts affected

117 by stars
ChartLatestAffected imagesRadar Score
ddosifyanteonVerified publisher1.7.53 of 13See more

ddosify anteon 1.7.5

3 of the 13 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
django@4.2.11
5.2.17
ddosify/selfhosted_backend:2.6.11ac323d52bfb4
django@4.1.13
5.2.17
ddosify/selfhosted_hammermanager:1.2.471b8768f49bc
django@3.2.24
5.2.17

Open the chart page →

27,220
argonix-apiargonix0.5.61 of 4See more

argonix-api argonix 0.5.6

1 of the 4 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/argonix-io/argonix-api:0.5.6dd18f26c9673
django@6.0.7
6.0.8

Open the chart page →

5,490
shynetatrox0.1.11 of 1See more

shynet atrox 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.12.0e821e31140f7
django@3.2.10
5.2.17

Open the chart page →

5,740
huebigdata-chartsVerified publisher1.0.41 of 2See more

hue bigdata-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
gethue/hue:4.10.05702b2c37ff9
django@3.2.4
5.2.17

Open the chart page →

88,704
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
django@5.0.9
5.2.17

Open the chart page →

10,852
camerahubcamerahub0.10.211 of 2See more

camerahub camerahub 0.10.21

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
camerahub/camerahub:0.36.23a5af37dd6e1b
django@3.2.18
5.2.17

Open the chart page →

2,595
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-web:3.0.06961eab190a2
django@5.2.11
5.2.17

Open the chart page →

16,932
paperless-ngxcharts-derwitt-devVerified publisher2.1.51 of 1See more

paperless-ngx charts-derwitt-dev 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.2.15fa76604a81d
django@5.2.16
5.2.17

Open the chart page →

4,533
cloudlaunchcloudve0.6.01 of 5See more

cloudlaunch cloudve 0.6.0

1 of the 5 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
django@3.2.9
5.2.17

Open the chart page →

13,032
cloudlaunch-servercloudve0.2.01 of 5See more

cloudlaunch-server cloudve 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
django@3.2.9
5.2.17

Open the chart page →

12,646
cloudlaunchservercloudve0.6.01 of 4See more

cloudlaunchserver cloudve 0.6.0

1 of the 4 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
django@3.2.9
5.2.17

Open the chart page →

12,167
galaxykubemancloudve2.10.11 of 7See more

galaxykubeman cloudve 2.10.1

1 of the 7 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
galaxy/cloudman-server:lateste5c265fe9fcd
django@4.0.7
5.2.17

Open the chart page →

16,723
authentikcluster-deploy0.2.01 of 1See more

authentik cluster-deploy 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
django@5.2.15
5.2.17

Open the chart page →

3,016
csghubcsghubVerified publisher2.5.01 of 34See more

csghub csghub 2.5.0

1 of the 34 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
opencsghq/label-studio:v2.5.047e22aa71870
django@5.1.15
5.2.17

Open the chart page →

53,831
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
django@5.0.3
5.2.17

Open the chart page →

12,932
dataflowcsghubVerified publisher2.5.01 of 7See more

dataflow csghub 2.5.0

1 of the 7 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
opencsghq/label-studio:v2.5.047e22aa71870
django@5.1.15
5.2.17

Open the chart page →

7,830
linkdingdeimosfr-charts1.0.31 of 1See more

linkding deimosfr-charts 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
sissbruecker/linkding:1.35.00c5dddf0b37c
django@5.1.1
5.2.17

Open the chart page →

6,553
seafilederp3.2.01 of 1See more

seafile derp 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:10.0.170628f29c663
django@3.2.16
5.2.17

Open the chart page →

78,570
devops-diplomdevops-diplom-chartVerified publisher0.8.01 of 2See more

devops-diplom devops-diplom-chart 0.8.0

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
alexeyr7/sf-test-app:latestdf0b41fdbd53
django@4.0.5
5.2.17

Open the chart page →

2,627
adventurelogdjjudas21Verified publisher0.1.11 of 3See more

adventurelog djjudas21 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/seanmorley15/adventurelog-backend:v0.13.00250d9cb0d74
django@5.2.13
5.2.17

Open the chart page →

8,224
codecovdoubanVerified publisher0.2.42 of 8See more

codecov douban 0.2.4

2 of the 8 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
codecov/self-hosted-api:24.4.10475cb1c3136
django@4.2.7
5.2.17
codecov/self-hosted-worker:24.4.1837f546b479b
django@4.2.11
5.2.17

Open the chart page →

26,156
seafileeleksbai0.1.11 of 3See more

seafile eleksbai 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:9.0.106693911bcc40
django@3.2.14
5.2.17

Open the chart page →

94,115
escvmschedulerescvmscheduler1.0.71 of 3See more

escvmscheduler escvmscheduler 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
swisscomcloud/esc-vm-scheduler-web:latestb6639d1a922e
django@3.2.16
5.2.17

Open the chart page →

5,200
business-api-ecosystemfiware1.1.01 of 4See more

business-api-ecosystem fiware 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
django@3.2.8
5.2.17

Open the chart page →

117,372
tandoorgabe565Verified publisher0.9.91 of 2See more

tandoor gabe565 0.9.9

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
django@4.2.18
5.2.17

Open the chart page →

2,398
babybuddygeek-cookbookVerified publisher1.2.21 of 1See more

babybuddy geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
linuxserver/babybuddy:1.10.2f7d7c7704249
django@4.0.2
5.2.17

Open the chart page →

1,562
seafilegeek-cookbookVerified publisher3.2.01 of 1See more

seafile geek-cookbook 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:8.0.7ed0fcda5e6a9
django@2.2.14
5.2.17

Open the chart page →

102,703
weblatehelm-charts-nr0.3.21 of 3See more

weblate helm-charts-nr 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
weblate/weblate:4.2.2-169c160d37a3c
django@3.1.1
5.2.17

Open the chart page →

8,523
paperlesshomelabcihelmchartstestVerified publisher9.1.91 of 1See more

paperless homelabcihelmchartstest 9.1.9

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
django@4.2.7
5.2.17

Open the chart page →

17,357
paperlesshpVerified publisher0.1.21 of 5See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
django@5.2.16
5.2.17

Open the chart page →

30,498
erpnextimprowisedVerified publisher3.3.01 of 3See more

erpnext improwised 3.3.0

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
improwised/erpnext-worker:v13.4.197280b55cbd4
django@1.11.29
5.2.17

Open the chart page →

7,098
healthchecksimprowisedVerified publisher1.1.11 of 2See more

healthchecks improwised 1.1.1

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
linuxserver/healthchecks:2.7.2023033194696dab3c50
django@4.1.7
5.2.17

Open the chart page →

2,696
label-studioinseefrlab2.3.11 of 3See more

label-studio inseefrlab 2.3.1

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
heartexlabs/label-studio:latestaa461572e8f9
django@5.1.15
5.2.17

Open the chart page →

3,141
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
django@4.2.27
5.2.17

Open the chart page →

19,848
inventreeinventreeOfficialVerified publisher0.4.301 of 2See more

inventree inventree 0.4.30

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
inventree/inventree:1.5.6b61e6a7534bf
django@5.2.16
5.2.17

Open the chart page →

5,820
ja-shortenerja-shortenerVerified publisher0.1.01 of 2See more

ja-shortener ja-shortener 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
cr0hn/ja-shortener:v0.1.414482d0bc4a1
django@5.2.3
5.2.17

Open the chart page →

2,212
shynetjuniorjpdj0.1.321 of 1See more

shynet juniorjpdj 0.1.32

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.13.1ba54f7797a6b
django@4.1.10
5.2.17

Open the chart page →

2,814
paperlessk8s-home-lab-repo11.0.11 of 1See more

paperless k8s-home-lab-repo 11.0.1

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
django@5.2.7
5.2.17

Open the chart page →

10,177
authentikkagiso-me0.1.11 of 1See more

authentik kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
django@5.2.11
5.2.17

Open the chart page →

5,138
huekatool1.0.81 of 1See more

hue katool 1.0.8

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
gethue/hue:4.11.011b649636e68
django@3.2.16
5.2.17

Open the chart page →

85,445
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
django@5.0.14
5.2.17

Open the chart page →

9,255
large-systems-djangolarge-systems-djangoVerified publisher1.0.01 of 1See more

large-systems-django large-systems-django 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ha33ona/python:test6affdfc644d0
django@2.2.26
5.2.17

Open the chart page →

4,596
linkdinglinkding0.2.31 of 1See more

linkding linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
sissbruecker/linkding:1.41.0-plusa222fb777e1f
django@5.1.10
5.2.17

Open the chart page →

41,238
oncall-hobbylovemew67Verified publisher0.0.51 of 2See more

oncall-hobby lovemew67 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
grafana/oncall:v1.13.11159b6b836fed
django@4.2.17
5.2.17

Open the chart page →

6,320
redisinsightlovemew67Verified publisher0.0.11 of 1See more

redisinsight lovemew67 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
redislabs/redisinsight:1.14.0b03ab1426d0d
django@4.1.7
5.2.17

Open the chart page →

1,883
servicesmicroslacVerified publisher0.4.04 of 8See more

services microslac 0.4.0

4 of the 8 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
microslac/auth:latest5c1eb1f5c64d
django@5.0.2
5.2.17
microslac/conversations:latest1b24afcd71ff
django@5.0.2
5.2.17
microslac/teams:latest0f75997fcbe5
django@5.0.2
5.2.17
microslac/users:latest216ea6832a56
django@5.0.2
5.2.17

Open the chart page →

33,576
paperless-ngxmt1905027.6.141 of 4See more

paperless-ngx mt190502 7.6.14

1 of the 4 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
django@5.2.7
5.2.17

Open the chart page →

12,979
babybuddynicholaswildeVerified publisher2.3.01 of 1See more

babybuddy nicholaswilde 2.3.0

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/babybuddy:version-v1.9.0841d90cf8e72
django@3.2.7
5.2.17

Open the chart page →

1,932
paperless-ngxoli-the-devVerified publisher1.1.11 of 1See more

paperless-ngx oli-the-dev 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
django@5.2.16
5.2.17

Open the chart page →

5,464
comacopencord1.0.02 of 9See more

comac opencord 1.0.0

2 of the 9 container images this version deploys carry CVE-2026-15307.

Container imageDigestPackageFixed in
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
django@1.11.11
5.2.17
omecproject/progran-synchronizer:comac-1.0.0d109a8e57e71
django@1.11.11
5.2.17

Open the chart page →

264,687

Container images carrying it

113 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
django@5.2.7
5.2.17
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
django@5.2.7
5.2.17
1
ghcr.io/paperless-ngx/paperless-ngx:1.8.09bbc9a90641e
django@4.0.6
5.2.17
1
ghcr.io/paperless-ngx/paperless-ngx:2.10.1a132c2ac7c57
django@4.2.13
5.2.17
1
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
django@4.2.7
5.2.17
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
django@5.2.7
5.2.17
1
ghcr.io/seanmorley15/adventurelog-backend:v0.13.00250d9cb0d74
django@5.2.13
5.2.17
1
ghcr.io/sissbruecker/linkding:1.45.061b2eb9eed8e
django@6.0
6.0.8
1
ghcr.io/substra/substra-backend:1.0.121967f54ec86
django@4.2.16
5.2.17
1
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
django@4.2.18
5.2.17
1
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
django@5.2.3
5.2.17
1
ghcr.io/zazukoians/qlever-ui:v0.10.151a7ec1c2de4
django@5.2.12
5.2.17
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
django@4.2.21
5.2.17
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.