FKIE_CVE-2026-15920

Vulnerability from fkie_nvd - Published: 2026-08-04 17:16 - Updated: 2026-08-04 18:16
Severity
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.
References
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92https://docs.djangoproject.com/en/dev/releases/security/
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92https://groups.google.com/g/django-announce
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92https://www.djangoproject.com/weblog/2026/aug/04/security-releases/
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://pypi.org/project/Django/",
          "defaultStatus": "unaffected",
          "packageName": "django",
          "product": "Django",
          "repo": "https://github.com/django/django/",
          "vendor": "djangoproject",
          "versions": [
            {
              "lessThan": "6.0.8",
              "status": "affected",
              "version": "6.0",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "6.0.8",
              "versionType": "python"
            },
            {
              "lessThan": "5.2.17",
              "status": "affected",
              "version": "5.2",
              "versionType": "python"
            },
            {
              "status": "unaffected",
              "version": "5.2.17",
              "versionType": "python"
            }
          ]
        }
      ],
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\r\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.\nDjango would like to thank Egor Saltykov for reporting this issue."
    }
  ],
  "id": "CVE-2026-15920",
  "lastModified": "2026-08-04T18:16:45.087",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-15920",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-04T17:16:24.319084Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-04T17:16:46.733",
  "references": [
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "url": "https://docs.djangoproject.com/en/dev/releases/security/"
    },
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "url": "https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b"
    },
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "url": "https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d"
    },
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "url": "https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a"
    },
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "url": "https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349"
    },
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "url": "https://groups.google.com/g/django-announce"
    },
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "url": "https://www.djangoproject.com/weblog/2026/aug/04/security-releases/"
    }
  ],
  "sourceIdentifier": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-83"
        }
      ],
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.