Is CVE-2026-54623 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54623 being exploited in the wild.

How severe is CVE-2026-54623?

High severity, with a CVSS score of 7.1, published 20 August 2026.

Which products and versions are affected?

django-cms (PyPI) < 5.0.8, ECOSYSTEM:introduced=0,fixed=5.0.8.

Is there a fix for CVE-2026-54623?

Yes. django-cms (PyPI): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54623 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54623?

Check whether you run django-cms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54623: django CMS plugin move endpoint denial of service via cyclic reparenting

Q: Which products and versions are affected?

django-cms (PyPI) < 5.0.8, ECOSYSTEM:introduced=0,fixed=5.0.8.

Q: Is there a fix for CVE-2026-54623?

Yes. django-cms (PyPI): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54623 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54623?

Check whether you run django-cms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54623 · Severity: high · CVSS 7.1 · Published 2026-08-20

django CMS is a content management system plugin that allows users to manage page layouts through a plugin tree interface. An authenticated staff member with permission to modify plugins can exploit the move endpoint to create circular references in the plugin hierarchy, causing subsequent requests to hang indefinitely while the application attempts to traverse the corrupted tree structure. This denial of service attack consumes worker processes and renders the affected pages inaccessible.

Technologies: django-cms (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54623 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54623 being exploited in the wild.
How severe is CVE-2026-54623?: High severity, with a CVSS score of 7.1, published 20 August 2026.
Which products and versions are affected?: django-cms (PyPI) < 5.0.8, ECOSYSTEM:introduced=0,fixed=5.0.8.
Is there a fix for CVE-2026-54623?: Yes. django-cms (PyPI): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54623 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54623?: Check whether you run django-cms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

django-cms (PyPI): upgrade to 5.0.8 or later
```
pip install "django-cms>=5.0.8"
```

Technical details

The vulnerability exists in the move_plugin endpoint (cms/admin/placeholderadmin.py) which accepts a plugin_parent POST parameter without validating that the target parent is not a descendant of the plugin being moved. The vulnerable code directly sets the parent_id without cycle detection. Descendant and ancestor traversal queries in cms/models/pluginmodel.py use WITH RECURSIVE CTEs (_get_descendants_cte, _get_ancestors_cte) with no cycle prevention or depth limits. When a cycle exists in the tree, these queries recurse indefinitely on PostgreSQL/SQLite or hit recursion limits on MySQL. The get_descendants() method is called during the move response and subsequent operations, causing request hangs. The attack requires authentication and CMS_PERMISSION/plugin-change permission on a placeholder. The fix in version 5.0.8 adds validation to reject moves that would create cycles before any tree mutation occurs.

Affected products

django-cms django-cms < 5.0.8

Identifiers

CVE-2026-54623
GHSA-8jj7-4v57-frf5
PYSEC-2026-3822

Timeline

2026-08-24: disclosed: Vulnerability published by GitHub Advisory Database
2026-06-12: patched: Fix released in version 5.0.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.