← Back to CVE Explorer

CVE-2026-15920

Full vulnerability record from the local CVENow database.

Description

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.

Severity
MEDIUM
CVSS score
5.1 (v4.0)
Vulnerability status
Analyzed
Source identifier
6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
Published
2026-08-04 17:16:46.733000
Last modified
2026-10-24 16:10:00.153000
View original CVE JSON 
{
  "id": "CVE-2026-15920",
  "sourceIdentifier": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
  "published": "2026-08-04T17:16:46.733",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\r\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.\nDjango would like to thank Egor Saltykov for reporting this issue."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en Django 5.2 anterior a 5.2.17 y 6.0 anterior a 6.0.8.\n’django.contrib.admin.utils.display_for_field()’ renderiza los valores de ’URLField’ como enlaces clicables en el administrador sin validar la URL. Un valor almacenado con un esquema inseguro se muestra como un enlace en las páginas de lista de cambios y de administración de solo lectura, lo que permite cross-site scripting contra los usuarios del personal que hacen clic en el enlace.\nLa explotación requiere que el valor inseguro ya esté almacenado en la base de datos. La validación de ’URLField’ a través de un ’ModelForm’ o el administrador rechaza los esquemas inseguros, por lo que esto afecta a las aplicaciones que persisten datos de ’URLField’ sin ejecutar la validación del modelo, por ejemplo, mediante escrituras directas de queryset, deserialización o importación masiva de entrada no confiable.\nDjango desea agradecer a Egor Saltykov por informar de este problema."
    }
  ],
  "affected": [
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "affectedData": [
        {
          "vendor": "djangoproject",
          "product": "Django",
          "defaultStatus": "unaffected",
          "collectionURL": "https://pypi.org/project/Django/",
          "packageName": "django",
          "repo": "https://github.com/django/django/",
          "versions": [
            {
              "version": "6.0",
              "lessThan": "6.0.8",
              "versionType": "python",
              "status": "affected"
            },
            {
              "version": "6.0.8",
              "versionType": "python",
              "status": "unaffected"
            },
            {
              "version": "5.2",
              "lessThan": "5.2.17",
              "versionType": "python",
              "status": "affected"
            },
            {
              "version": "5.2.17",
              "versionType": "python",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "ACTIVE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-04T17:16:24.319084Z",
          "id": "CVE-2026-15920",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-83"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.2",
              "versionEndExcluding": "5.2.17",
              "matchCriteriaId": "E20DAA60-EC17-41F8-A6F0-C6F42F887FE6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "6.0",
              "versionEndExcluding": "6.0.8",
              "matchCriteriaId": "D2E4E199-5735-4911-92F2-73B0AA1D173E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://docs.djangoproject.com/en/dev/releases/security/",
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b",
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d",
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a",
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349",
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://groups.google.com/g/django-announce",
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Mailing List"
      ]
    },
    {
      "url": "https://www.djangoproject.com/weblog/2026/aug/04/security-releases/",
      "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}