CVE-2026-54625: django CMS page cache ignores plugin Vary headers

CVE-2026-54625 · Severity: medium · CVSS 4.8 · Published 2026-08-20

django CMS's page caching feature fails to account for content variations declared by plugins, causing the first visitor's version of a page to be served to all subsequent users. This vulnerability allows information disclosure when plugins customize content based on visitor attributes (e.g., location, user type), and enables unauthenticated attackers to inject malicious content into the cache that will be displayed to other users.

Technologies: django-cms (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54625 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54625 being exploited in the wild.
How severe is CVE-2026-54625?
Medium severity, with a CVSS score of 4.8, published 20 August 2026.
Which products and versions are affected?
django-cms (PyPI) < 5.0.8, ECOSYSTEM:introduced=0,fixed=5.0.8.
Is there a fix for CVE-2026-54625?
Yes. django-cms (PyPI): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54625 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54625?
Check whether you run django-cms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • django-cms (PyPI): upgrade to 5.0.8 or later
    pip install "django-cms>=5.0.8"

Technical details

The vulnerability exists in the `_page_cache_key` function (cms/cache/page.py), which constructs cache keys using only cache prefix, site, language, path, and timezone—omitting request header values that plugins declare via `get_vary_cache_on()`. While the response's HTTP `Vary` header is correctly set via `patch_vary_headers()`, the underlying cache retrieval logic ignores these header-dependent variations. An attacker can craft requests with specific header values to prime the anonymous page cache; the poisoned variant is then served to all subsequent visitors until cache expiration. The vulnerability requires CMS_PAGE_CACHE to be enabled and at least one plugin implementing `get_vary_cache_on()`. Fixed in version 5.0.8 by incorporating plugin-declared vary header values into the cache key and persisting the set of vary headers on write.

Affected products

  • Django CMS Project django-cms < 5.0.8

Identifiers

  • CVE-2026-54625
  • GHSA-fwjf-m4qw-9f2x
  • PYSEC-2026-3824

Timeline

  • 2026-06-12: disclosed
  • 2026-06-12: patched: Fixed in version 5.0.8
  • 2026-08-24: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.