# CVE-2015-5081: django-cms CSRF vulnerability in page management

Source: https://junglewise.ai/threats/cve-2015-5081-django-cms-csrf-vulnerability-in-page-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-08-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2015-5081 · Severity: low · CVSS 3 · Published 2017-08-18

django-cms is a popular content management system plugin for Django web applications. This vulnerability allows attackers to exploit cross-site request forgery (CSRF) attacks to trick authenticated administrators into performing unauthorized actions, such as modifying pages or other site content without their knowledge or consent. An attacker could potentially manipulate a privileged user into making unintended changes to the website.

Technologies: [django-cms (PyPI)](https://junglewise.ai/threats/technologies/django-cms). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2015-5081 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2015-5081 being exploited in the wild.

**How severe is CVE-2015-5081?** Low severity, with a CVSS score of 3, published 18 August 2017.

**Which products and versions are affected?** django-cms (PyPI) ECOSYSTEM:introduced=0,fixed=3.0.14, GIT:introduced=0,fixed=f77cbc607d6e2a62e63287d37ad320109a2cc78a|ECOSYSTEM:introduced=0,fixed=3.0.14,introduced=3.1,fixed=3.1.1.

**Is there a fix for CVE-2015-5081?** Yes. django-cms (PyPI): upgrade to 3.0.14, 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2015-5081 attacked?** It is attacked over the network.

**Am I affected by CVE-2015-5081?** Check whether you run django-cms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- django-cms (PyPI): upgrade to 3.0.14, 3.1.1 or later

  ```sh
  pip install "django-cms>=3.1.1"
  ```


## Technical details

The vulnerability is a cross-site request forgery (CSRF) vulnerability (CWE-352) in django-cms versions before 3.0.14 and 3.1.x before 3.1.1. Sensitive admin endpoints handling page management operations, such as `change_template`, `move_page`, and `copy_language`, lacked proper CSRF protection via POST-only decorators (e.g., `@require_POST`). An attacker can craft a malicious webpage that, when visited by an authenticated administrator, silently triggers unintended administrative actions. The fix involves adding CSRF protection decorators to affected endpoints. Patches are available in versions 3.0.14 and 3.1.1 and later.

## Affected products

- Django CMS django-cms before 3.0.14, 3.1.x before 3.1.1

## Identifiers

- CVE-2015-5081
- GHSA-2pqc-gv8q-pvqv
- PYSEC-2017-11

## Timeline

- 2015-06-27: disclosed
- 2015-06-27: patched: Fixed in versions 3.0.14 and 3.1.1

## References

- [https://github.com/divio/django-cms/commit/f77cbc607d6e2a62e63287d37ad320109a2cc78a](https://github.com/divio/django-cms/commit/f77cbc607d6e2a62e63287d37ad320109a2cc78a)

## Related threats

- [django CMS stored XSS in edit-mode plugin exception rendering](https://junglewise.ai/threats/cve-2026-75526-django-cms-stored-xss-in-edit-mode-plugin-exception-rendering)
- [django CMS page duplicate authorization bypass](https://junglewise.ai/threats/cve-2026-63003-django-cms-page-duplicate-authorization-bypass)
- [django CMS authorization bypass in render_object_structure](https://junglewise.ai/threats/cve-2026-61663-django-cms-authorization-bypass-in-render-object-structure)
- [django CMS structure endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-54624-django-cms-structure-endpoint-authorization-bypass)
- [django CMS clipboard copy authorization bypass](https://junglewise.ai/threats/cve-2026-54622-django-cms-clipboard-copy-authorization-bypass)