Executive brief
django CMS is a content management system plugin that allows users to manage page layouts through a plugin tree interface. An authenticated staff member with permission to modify plugins can exploit the move endpoint to create circular references in the plugin hierarchy, causing subsequent requests to hang indefinitely while the application attempts to traverse the corrupted tree structure. This denial of service attack consumes worker processes and renders the affected pages inaccessible.
Technical details
The vulnerability exists in the move_plugin endpoint (cms/admin/placeholderadmin.py) which accepts a plugin_parent POST parameter without validating that the target parent is not a descendant of the plugin being moved. The vulnerable code directly sets the parent_id without cycle detection. Descendant and ancestor traversal queries in cms/models/pluginmodel.py use WITH RECURSIVE CTEs (_get_descendants_cte, _get_ancestors_cte) with no cycle prevention or depth limits. When a cycle exists in the tree, these queries recurse indefinitely on PostgreSQL/SQLite or hit recursion limits on MySQL. The get_descendants() method is called during the move response and subsequent operations, causing request hangs. The attack requires authentication and CMS_PERMISSION/plugin-change permission on a placeholder. The fix in version 5.0.8 adds validation to reject moves that would create cycles before any tree mutation occurs.
Affected products
- django-cms django-cms < 5.0.8
Timeline
- 2026-08-24: disclosed: Vulnerability published by GitHub Advisory Database
- 2026-06-12: patched: Fix released in version 5.0.8