An incomplete fix for a prior spatial lookup vulnerability allows an attacker who can supply raw byte values to craft a VRT document that references an external raster source, forcing the Django application to make unsolicited network requests. Although the application does not execute arbitrary code, the ability to trigger external connections can be abused for data exfiltration, reconnaissance, or downstream attacks on the target of the connection.

Django versions prior to 6.1.2, 6.0.9, or 5.2.18 are affected. Earlier unsupported series such as 5.1.x, 5.0.x, and 4.2.x may also be vulnerable.

The CVSS score of 6.9 indicates a moderate severity. No public exploit information exists and the vulnerability is not listed in CISA KEV. Because it exploits a server-side request forgery mechanism triggered by application input, the likelihood of exploitation depends on whether the vulnerable application processes spatial byte data. The attack vector is inferred to be through any web request that includes disallowed byte values in a spatial lookup context.