nicetop1027/cve-2026-pending-django-summernote-rce
This repository contains a Proof of Concept (PoC) for a Conditional Remote Code Execution (RCE) vulnerability discovered in django-summernote version 0.8.20.0 (and earlier).
The vulnerability exists in the lack of strict dependency enforcement in setup.py and the fallback logic in forms.py.
The django-summernote package treats the Pillow library (required for strict image validation) as an optional dependency. If Pillow is not installed on the server, the UploadForm gracefully downgrades the file input field from forms.ImageField to the generic forms.FileField.
Vulnerable Code (forms.py):
try:
from PIL import Image
FIELD = forms.ImageField # Validates image content
except ImportError:
FIELD = forms.FileField # Accepts ANY file type (Dangerous)
This behavior allows an attacker to upload arbitrary files (e.g., .php, .py, .sh, .html) instead of images, leading to Remote Code Execution (RCE) or XSS, as the views.py relies solely on form validation.
Install django-summernote without Pillow:
pip install django-summernote
pip uninstall Pillow # Ensure Pillow is gone
Run the PoC:
python3 poc.py
Expected Output:
[+] Verified: Pillow is NOT installed. Vulnerable logic active.
[*] Attempting to upload a Web Shell (.php)...
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[!!!] VULNERABILITY SUCCESS: SHELL UPLOADED [!!!]
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[+] Form Validation Passed for: exploit.php
Users should ensure Pillow is installed in their environment to enforce image validation:
pip install Pillow
Maintainers should move Pillow to install_requires in setup.py or enforce ImageField usage hard dependency.