django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)GHSA-fwjf-m4qw-9f2x
MEDIUMFix: django-cms/django-cms#8646GHSA-fwjf-m4qw-9f2x is a medium-severity (CVSS 4.8) CWE-349 vulnerability in django-cms. A fix is available for django-cms — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-fwjf-m4qw-9f2x.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-fwjf-m4qw-9f2x by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,386 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
django-cmsReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
The CMS page cache key ignores the request headers that plugins declare via get_vary_cache_on(). The header is added to the response Vary header, but the CMS's own cache key does not incorporate the header values, so the first visitor's variant is served to all subsequent visitors regardless of their header values.
Details
_page_cache_key (in cms/cache/page.py) keys only on cache prefix, site, language, path and timezone. set_page_cache collects the plugin-declared vary headers and calls patch_vary_headers(response, ...) (affecting only the emitted Vary header), but stores and retrieves the cached page under the header-agnostic key. get_page_cache therefore returns whichever variant was cached first.
Impact
- Information disclosure: when a plugin varies its output on a request header (e.g.
Country-Code), the variant rendered for the first anonymous visitor is served to everyone until the entry expires, leaking request-specific content across users. - Cache poisoning: an unauthenticated attacker can prime the anonymous page cache with content rendered from attacker-chosen header values, which is then served to subsequent visitors.
Applies only when CMS_PAGE_CACHE is enabled and at least one plugin implements get_vary_cache_on().
Patches
Fixed in 5.0.8: the page cache now folds the request's values implements get_vary_cache_on().
Patches
Fixed in 5.0.8: the page cache now folds the request's values for plugin-declared vary headers into the content key. The set of vary headers is persisted on write and looked up first on read (mirroring Django's learn_cache_key/get_cache_key); a missing header-list entry degrades to a cache miss, never a wrong-variant hit.
Workarounds
Disable CMS_PAGE_CACHE, or avoid plugins that rely on get_vary_cache_on(), until upgraded.
Credits
Reported by the security team at the University of Sydney ([@reporter]).
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | django-cms | all versions | 5.0.8pip install --upgrade 'django-cms==5.0.8' |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for django-cms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update django-cms to 5.0.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-fwjf-m4qw-9f2x is resolved across your whole dependency graph.
Workarounds
Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.
Frequently Asked Questions
Is GHSA-fwjf-m4qw-9f2x in your dependencies?
Find it across PyPI, including transitive dependencies.