Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| django-cms | pip | < 5.0.8 | 5.0.8 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-54623, describes a Denial of Service (DoS) issue in django CMS where a staff user with specific permissions can create a cyclic dependency in the plugin tree. This cycle causes recursive queries, specifically _get_descendants_cte and _get_ancestors_cte, to loop indefinitely or exceed database recursion limits, leading to resource exhaustion and DoS.
The provided commit 7642a98ab3170793c0b27b4125dd1f3d318b8a1c directly addresses this issue. The key change is in cms/admin/placeholderadmin.py within the move_plugin method. Prior to this patch, move_plugin accepted an attacker-controlled plugin_parent value without validating if it would create a cycle. The added code explicitly checks if the target_parent is the plugin itself or one of its descendants using plugin._get_descendants_ids(). If a cyclic condition is detected, it returns an HttpResponseBadRequest, preventing the tree corruption.
Therefore, PlaceholderAdmin.move_plugin is identified as a vulnerable function because its lack of input validation allowed the creation of the cyclic tree. The CMSPlugin._get_descendants_ids (and its underlying CTEs) is identified as vulnerable because it's the function that would be called during operations like rendering, copying, or deleting on a corrupted tree, leading to the infinite recursion and DoS. The patch in move_plugin prevents the state that would trigger the _get_descendants_ids vulnerability.
PlaceholderAdmin.move_plugincms/admin/placeholderadmin.py
CMSPlugin._get_descendants_idscms/models/pluginmodel.py