Description

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled plugin_parent value without rejecting a plugin’s own identifier or a descendant identifier. A staff user with plugin-change permission under CMS_PERMISSION can create a parent_id cycle in the plugin tree. The _get_descendants_cte and _get_ancestors_cte queries in cms/models/pluginmodel.py have no cycle guard, so get_descendants() and later rendering, copy, or delete operations can recurse indefinitely or reach a database recursion limit, corrupting the tree and consuming request workers. This issue is fixed in versions 5.0.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-20T18:16:28.013Z",
  "pubdate": "2026-08-20T18:16:28.013Z",
  "executiveSummary": "An improper control flow vulnerability exists within the plugin tree management functionality of django CMS prior to version 5.0.8. The vulnerability allows a malicious actor with specific administrative privileges to introduce structural cycles into the hierarchical plugin model.\nThe primary impact of this flaw is a Denial of Service (DoS) condition affecting request workers and database integrity. When recursive traversal methods such as get_descendants() attempt to process a corrupted plugin tree containing circular references, they encounter infinite recursion or exhaust database recursion limits.\nThe affected system is django CMS prior to version 5.0.8, specifically involving modules within the admin interface and core model definitions. Risk implications include application instability, resource exhaustion, and potential data corruption of the underlying plugin structure.\nAttacker capabilities require authenticated access as a staff user with plugin-change permission under CMS_PERMISSION. Exploitation requirements necessitate interacting with specific administrative endpoints to supply malicious parent identifiers that violate tree hierarchy invariants.",
  "technicalDetails": "The vulnerability resides in the move_plugin endpoint located in cms/admin/placeholderadmin.py, where user-supplied input corresponding to the plugin_parent value is accepted without adequate validation checks to prevent circular relationships. Specifically, the implementation fails to reject scenarios where a plugin is assigned as a child of its own identifier or as a child of any of its descendant identifiers.\nThe root cause is compounded by the implementation of recursive traversal utilities in cms/models/pluginmodel.py. The functions _get_descendants_cte and _get_ancestors_cte lack explicit cycle guards. Consequently, when methods like get_descendants() execute subsequent operations such as rendering, copying, or deleting plugins, they recurse indefinitely or reach the database recursion limit.\nThe attack flow proceeds as follows: First, an attacker authenticates as a staff user possessing plugin-change permissions within an environment utilizing CMS_PERMISSION. Second, the attacker sends a crafted request to the move_plugin endpoint, manipulating the plugin_parent parameter to point to the plugin's own ID or a descendant ID. Third, the application updates the plugin tree without validating the structural integrity, resulting in a parent_id cycle.\nPost-exploitation impact manifests during subsequent read, copy, delete, or rendering operations that invoke descendant queries. The absence of cycle guards forces the application or database engine into infinite recursion, consuming available request workers, exhausting system memory or database resources, and culminating in a denial of service."
}