CVE-2026-1207CWE-89

Potential SQL injection via raster lookups on PostGIS

Medium · published February 3, 2026

CVSS v3.1
5.4
EPSS
13%
Percentile
96.3
In the wild
Unconfirmed
What it is

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.

Django would like to thank Tarek Nakkouch for reporting this issue.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.12819 · 96.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-02-03T14:35Z
EPSS history
Timeline
  • 03 FEB 14:35Z
    Potential SQL injection via raster lookups on PostGIS
    cvelistv5