CVE-2026-15920

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link. Exploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input. Django would like to thank Egor Saltykov for reporting this issue.

• CWE-83

• https://docs.djangoproject.com/en/dev/releases/security/Patch, Vendor Advisory
• https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931bPatch
• https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46dPatch
• https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508aPatch
• https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349Patch
• https://groups.google.com/g/django-announceMailing List
• https://www.djangoproject.com/weblog/2026/aug/04/security-releases/Vendor Advisory

Published

Aug 4, 2026

Last Modified

Aug 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15913In versions prior to 7.10.2 a path traversal vulnerability i…7.7
• CVE-2026-15915IBM Concert 1.0.0 through 3.0.0 could allow a local attacker…6.2
• CVE-2026-15916Missing Authorization vulnerability in Drupal Drupal core al…4.2
• CVE-2026-15917Improper Neutralization of Input During Web Page Generation …4.7
• CVE-2026-15918VikAppointments Service Booking Calendar wordpress plugin is…7.5
• CVE-2026-1592Foxit PDF Editor Cloud (pdfonline) contains a stored cross-s…5.4
• CVE-2026-15921Node Version Manager (nvm) is a POSIX-compliant shell functi…3.1
• CVE-2026-15923The Zephyr SDIO subsystem function sdio_io_rw_extended_helpe…4.6
• CVE-2026-15924Zephyr's TLS socket layer in subsys/net/lib/sockets/sockets_…5.9
• CVE-2026-15925Improper TLS hostname verification in Snowflake Connector fo…9.2
• CVE-2026-15926Rejected reason: Red Hat Product Security has determined tha…
• CVE-2026-15927A flaw was found in Red Hat Quay's repository-level mirror c…6.8