---
id: CVE-2026-75526
title: >-
  django CMS is an easy-to-use and developer-friendly enterprise content
  management system powered by Django
summary: >-
  django CMS is an easy-to-use and developer-friendly enterprise content
  management system powered by Django. From 5.0.8 until 5.0.9,
  ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored,
  attacker-controlled values…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: django-cms
product: django-cms
affected:
  - 'django-cms >= 5.0.8, < 5.0.9'
patched:
  - django-cms 5.0.9
published: '2026-08-20'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:19:49.197'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75526'
references:
  - url: >-
      https://github.com/django-cms/django-cms/commit/b56a568844ff3702495945f73a31d0868285bf88
    label: security-advisories@github.com
  - url: 'https://github.com/django-cms/django-cms/pull/8711'
    label: security-advisories@github.com
  - url: 'https://github.com/django-cms/django-cms/releases/tag/5.0.9'
    label: security-advisories@github.com
  - url: >-
      https://github.com/django-cms/django-cms/security/advisories/GHSA-hvq6-2r72-p2x7
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-hvq6-2r72-p2x7'
  - url: 'https://github.com/django-cms/django-cms'
  - url: 'https://pypi.org/project/django-cms'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75526'
tags:
  - nvd
  - ghsa
  - pip
  - osv
epss: 0.00261
epssPercentile: 0.16039
aliases:
  - GHSA-hvq6-2r72-p2x7
  - PYSEC-2026-3825
ecosystem: pip
ingestedAt: '2026-08-20T18:59:54.003Z'
---

## Overview

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values to ContentRenderer.render_exception when plugin rendering fails in edit mode. Values from get_short_description(), the exception message, the placeholder, or placeholder.source are interpolated into a cms-rendering-exception heading and later returned through mark_safe. Because the heading is not escaped, stored HTML executes in an editor’s browser, and settings.DEBUG does not prevent the custom heading from rendering. The fix uses format_html to escape the message before safe placeholder output is returned. This issue is fixed in versions 5.0.9.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-75526)

Affected packages:

- `django-cms >= 5.0.8, < 5.0.9`

Patched in:

- `django-cms 5.0.9`

Source: https://github.com/advisories/GHSA-hvq6-2r72-p2x7