DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-54625: CVE-2026-54625: Server-Side Page Cache Bypass and Cache Poisoning in django CMS

#security #cve #cybersecurity

CVE-2026-54625: Server-Side Page Cache Bypass and Cache Poisoning in django CMS

Vulnerability ID: CVE-2026-54625
CVSS Score: 4.8
Published: 2026-08-24

Prior to version 5.0.8, django CMS fails to respect dynamically declared Vary HTTP headers in its internal page cache. This allows remote attackers to bypass authorization, leak sensitive information across user sessions, or poison the page cache by sending requests with custom headers.

TL;DR

django CMS versions before 5.0.8 and 5.1.0 contain a cache key computation flaw that ignores plugin-declared HTTP Vary headers, leading to server-side cache poisoning and information disclosure.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-524 / CWE-349
  • Attack Vector: Network
  • CVSS v3.1 Score: 4.8
  • EPSS Score: 0.00147
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • django-cms
  • django-cms: < 5.0.8 (Fixed in: 5.0.8)
  • django-cms: >= 5.1.0a1, < 5.1.0 (Fixed in: 5.1.0)

Code Analysis

Commit: d5dc1ef

Implement Vary-On Key Reconstruction to securely partition page caches by header values dynamically declared by plugins.

Commit: 8758714

Ensure Vary-On cache keys are safely initialized and hashed even when empty, preventing key collision.

Exploit Details

  • GitHub Core Test Suite: Unit test assertions showing dynamic request variations and verify-on isolation testing.

Mitigation Strategies

  • Disable internal page caching by setting CMS_PAGE_CACHE = False
  • Upgrade to django CMS version 5.0.8 or 5.1.0
  • Sanitize or strip custom vary headers at the upstream reverse proxy or CDN level

Remediation Steps:

  1. Upgrade django-cms using pip: pip install --upgrade django-cms>=5.0.8
  2. Verify the application configuration and test plugin cache partitions
  3. Clear existing cache entries using the cache backend's management tools or the Django caching API
  4. Ensure upstream CDNs or proxies are configured to prevent header injection from untrusted clients

References

Read the full report for CVE-2026-54625 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)