Vulnerability · Published Aug 4, 2026 · Assigned by DSF
CVE-2026-15920Potential cross-site scripting via URLField values in the admin
Medium 6.1
In plain English
A medium-severity security flaw in Django from djangoproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | py3-django | 5.2.17-r0 | ALPINE-CVE-2026-15920 |
| Debian:12 | python-django | 3:3.2.25-0+deb12u4 | DEBIAN-CVE-2026-15920 |
| Debian:13 | python-django | no fix listed | DEBIAN-CVE-2026-15920 |
| Debian:14 | python-django | 3:5.2.17-1 | DEBIAN-CVE-2026-15920 |
| Ubuntu:22.04:LTS | python-django | no fix listed | UBUNTU-CVE-2026-15920 |
| Ubuntu:24.04:LTS | python-django | no fix listed | UBUNTU-CVE-2026-15920 |
| Ubuntu:26.04:LTS | python-django | no fix listed | UBUNTU-CVE-2026-15920 |
| Ubuntu:26.10 | python-django | no fix listed | UBUNTU-CVE-2026-15920 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| djangoproject | Django | 6.0 – before 6.0.85.2 – before 5.2.17 |
Weakness: CWE-83 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- Django security archive vendor-advisory
- Django releases announcements mailing-list
- https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d patch
- https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a patch
- https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b patch
- https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349 patch
- Django security releases issued: 6.0.8 and 5.2.17 vendor-advisory