What is CVE-2026-1207?

CVE-2026-1207 is a vulnerability in Djangoproject Django, classified under SQL Injection. Published 2026-02-03.

Is CVE-2026-1207 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SQL Injection in Djangoproject Django

CVE-2026-1207

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported…

Vulnerability class: SQL Injection

EPSS: 0.053 (90.2th percentile) — read the EPSS interpretation.

Affected products

Djangoproject Django — versions 6.0, 6.0.2, 5.2

Weakness classification (CWE)

CWE-89 — SQL Injection

Public proof-of-concept exploits

sw0rd1ight/CVE-2026-1207

References

Django security archive (vendor-advisory)
Django releases announcements (mailing-list)
Django security releases issued: 6.0.2, 5.2.11, and 4.2.28 (vendor-advisory)

Frequently asked questions

What is CVE-2026-1207?: CVE-2026-1207 is a vulnerability in Djangoproject Django, classified under SQL Injection. Published 2026-02-03.
Is CVE-2026-1207 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.