CVE-2026-15920

Description

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.

Traduire en français

Produits concernés

• djangoproject Django

Scores CVSS

Faiblesses (CWE)

• CWE-83

Références

• https://docs.djangoproject.com/en/dev/releases/security/ PatchVendor Advisory
• https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b Patch
• https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d Patch
• https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a Patch
• https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349 Patch
• https://groups.google.com/g/django-announce Mailing List
• https://www.djangoproject.com/weblog/2026/aug/04/security-releases/ Vendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories