Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| django-cms | pip | < 5.0.8 | 5.0.8 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-54625, in django CMS stems from its page cache mechanism failing to properly account for plugin-declared Vary headers. Specifically, the _page_cache_key function in cms/cache/page.py was designed to generate a cache key without incorporating these crucial headers. This meant that if a plugin varied content based on a header (e.g., Country-Code), all requests, regardless of their Country-Code value, would generate the same cache key.
When set_page_cache was called, it would store the response using this header-agnostic key. The first request to hit the cache would effectively 'prime' it. Subsequent requests, even with different Vary header values, would then retrieve this same cached content via get_page_cache, as it also used the flawed _page_cache_key to look up entries. This led to two primary issues: information disclosure (one user receiving another's request-specific content) and cache poisoning (an unauthenticated attacker could prime the cache with malicious content).
The provided patches directly address this by modifying _page_cache_key to accept and incorporate vary_on headers into the cache key. set_page_cache was updated to pass these vary_on headers to _page_cache_key during storage and also to explicitly cache the vary_on headers themselves. Finally, get_page_cache was modified to first retrieve the vary_on headers from the cache and then use them when generating the key for content retrieval, ensuring that the correct, header-specific variant is fetched. These changes collectively ensure that the cache key accurately reflects all necessary request parameters, preventing cache collisions and the associated security risks.
_page_cache_keycms/cache/page.py
get_page_cachecms/cache/page.py
set_page_cachecms/cache/page.py