Fluid Attacks Database

Description

Django has an SQL Injection issue An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

Raster lookups on RasterField (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Tarek Nakkouch for reporting this issue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 12	python-django	=3:3.2.19-1 \|\| =3:3.2.19-1+deb12u1 \|\| =3:3.2.19-1+deb12u1~bpo11+1 \|\| =3:3.2.19-1+deb12u2 \|\| =3:3.2.20-1 \|\| =3:3.2.20-1.1 \|\| =3:3.2.21-1 \|\| =3:3.2.25-0+deb12u1 \|\| >=0 <3:3.2.25-0+deb12u2	3:3.2.25-0+deb12u2
debian 13	python-django	=3:4.2.23-1 \|\| =3:4.2.24-1 \|\| =3:4.2.25-1 \|\| =3:4.2.25-2 \|\| =3:4.2.26-1 \|\| =3:4.2.27-0+deb13u1 \|\| =3:4.2.27-1 \|\| =3:4.2.27-2 \|\| >=0 <3:4.2.28-0+deb13u1	3:4.2.28-0+deb13u1
debian 11	python-django	=2:2.2.24-1 \|\| =2:2.2.25-1~deb11u1 \|\| =2:2.2.26-1~deb11u1 \|\| =2:2.2.28-1~deb11u1 \|\| =2:2.2.28-1~deb11u10 \|\| =2:2.2.28-1~deb11u11 \|\| =2:2.2.28-1~deb11u2 \|\| =2:2.2.28-1~deb11u3 \|\| =2:2.2.28-1~deb11u4 \|\| =2:2.2.28-1~deb11u5 \|\| =2:2.2.28-1~deb11u6 \|\| =2:2.2.28-1~deb11u7 \|\| =2:2.2.28-1~deb11u8 \|\| =2:2.2.28-1~deb11u9 \|\| >=0 <2:2.2.28-1~deb11u12	2:2.2.28-1~deb11u12
debian 14	python-django	=3:4.2.23-1 \|\| =3:4.2.24-1 \|\| =3:4.2.25-1 \|\| =3:4.2.25-2 \|\| =3:4.2.26-1 \|\| =3:4.2.27-1 \|\| =3:4.2.27-2 \|\| >=0 <3:4.2.28-1	3:4.2.28-1
pypi	django	>=6.0a1 <6.0.2 \|\| >=5.2a1 <5.2.11 \|\| >=4.2a1 <4.2.28	6.0.2, 5.2.11, 4.2.28

Aliases

1. CVE-2026-12072. NVD-2026-12073. OSV-DEBIAN-2026-12074. OSV-2026-12075. GCVE-2026-12076. SECURITY-TRACKER-CVE-2026-1207

References

1. https://vulncheck.com/cve/CVE-2026-12072. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-1207.yaml3. https://github.com/django/django/commit/81aa5292967cd09319c45fe2c1a525ce7b6684d84. https://docs.djangoproject.com/en/dev/releases/security5. https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-44.yaml6. https://groups.google.com/g/django-announce7. https://www.djangoproject.com/weblog/2026/feb/03/security-releases

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.