CVE-2026-6611
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability was found in liangliangyy DjangoBlog up to version 2.1.0.0 involving a hard-coded cryptographic key in djangoblog/settings.py within the File Upload Endpoint component. Manipulating the SECRET_KEY argument results in use of a hard-coded key. Remote exploitation is possible but rated as high complexity and difficult exploitability.
Risk Assessment
Exposure or predictability of the SECRET_KEY could enable session or token forgery, weakening application security. High attack complexity limits but does not eliminate the risk.
Recommendation
Replace the hard-coded SECRET_KEY with a unique random key stored outside source code (e.g., environment variables) and rotate the key. Track project updates for a potential fix.
Other vulnerabilities in DjangoBlog
See all- CVE-2026-6610Low
A vulnerability was found in liangliangyy DjangoBlog up to 2.1.0.0 in an unknown function of the djangoblog/settings.py file, related to settings handling. Manipulation of the USER/PASSWORD arguments leads to hard-coded credentials. The attack can be launched remotely but requires a high level of complexity. The exploit has been publicly disclosed, and the vendor did not respond.
- CVE-2026-6609Medium
A flaw was found in liangliangyy DjangoBlog up to 2.1.0.0 affecting the form_valid function in oauth/views.py. Manipulating the oauthid argument causes improper authorization, and the attack may be initiated remotely. The exploit has been published.
- CVE-2026-6579Medium
A weakness was identified in liangliangyy DjangoBlog up to 2.1.0.0 affecting an unknown function in blog/views.py of the Clean Endpoint component, causing missing authentication. The attack may be initiated remotely, and a public exploit could be used. The vendor was contacted but did not respond.
- CVE-2026-6578Medium
A security flaw was discovered in DjangoBlog up to version 2.1.0.0 affecting djangoblog/settings.py, where a hard-coded SECRET_KEY is used. The attack can be launched remotely but requires high complexity. The exploit has been publicly released and the vendor did not respond.
- CVE-2026-6576Medium
A vulnerability was determined in liangliangyy DjangoBlog up to 2.1.0.0 in the CommandHandler function of servermanager/api/commonapi.py within the WeChat Bot Interface component. Manipulation of the Source argument leads to command injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized; the vendor was contacted but did not respond.
Original NVD description (English source)
A vulnerability was found in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of the component File Upload Endpoint. Performing a manipulation of the argument SECRET_KEY results in use of hard-coded cryptographic key . Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS