CVE-2026-15920

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.display_for_field() renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. URLField validation through a ModelForm or the admin rejects unsafe schemes, so this affects applications that persist URLField data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.

Database specific

{
    "cna_assigner": "DSF",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15920.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "6.0"
                },
                {
                    "fixed": "6.0.8"
                },
                {
                    "introduced": "5.2"
                },
                {
                    "fixed": "5.2.17"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "5.2"
                },
                {
                    "fixed": "5.2.17"
                },
                {
                    "introduced": "6.0"
                },
                {
                    "fixed": "6.0.8"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cwe_ids": [
        "CWE-83"
    ]
}

References

Affected packages

Git / github.com/django/django

Affected ranges

Type

GIT

Repo

https://github.com/django/django

Events

Introduced

Fixed

13debb622a32720bda1bccda7622fd14fbf3931b

Fixed

47511a21026cdd721d8fbf8571cc079bc38bb46d

Fixed

5a260d309a4c8010c2ebda24eb758a5d95e2508a

Fixed

b9adb81339cc418f8f56b1050cca6dfec3ab6349

Database specific

{
    "source": "REFERENCES"
}

Affected versions

1.*

1.0

1.1

1.2

1.2.1

1.3

1.4

1.7a2

5.*

5.2

5.2.1

5.2.10

5.2.11

5.2.12

5.2.13

5.2.14

5.2.15

5.2.16

5.2.2

5.2.3

5.2.4

5.2.5

5.2.6

5.2.7

5.2.8

5.2.9

5.2a1

5.2b1

5.2rc1

6.*

6.0

6.0.1

6.0.2

6.0.3

6.0.4

6.0.5

6.0.6

6.0.7

6.0a1

6.0b1

6.0rc1

6.1a1

6.1b1

6.1rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15920.json"