CVE-2026-54625: Server-Side Page Cache Bypass and Cache Poisoning in django CMS

The core design of django CMS relies on an internal server-side page caching engine, controlled by the CMS_PAGE_CACHE setting, to store fully rendered HTML pages within high-performance key-value backends such as Redis or Memcached. This system acts as a high-speed delivery mechanism, minimizing application layer rendering times and database query operations by serving static variants of content pages directly to inbound web clients.

However, a design discrepancy exists within the caching architecture prior to version 5.0.8. While individual plugins on a page can dynamically declare HTTP Vary headers (for example, utilizing the get_vary_cache_on() lifecycle hook to enforce client-specific rendering based on unique HTTP request headers), the internal server-side caching engine did not dynamically adapt its internal storage index lookup to match these changes.

This discrepancy creates an information isolation bypass. The server-side cache generates a static query index regardless of the dynamic variables declared by plugins, which allows unauthorized access to session-specific layouts, localized interface attributes, and access-restricted content. This behavior directly corresponds to CWE-524 (Use of Cache Containing Sensitive Information) and CWE-349 (Acceptance of Extraneous Untrusted Data with Trusted Data).

To understand the root cause of the flaw, it is necessary to examine how cache keys are resolved in cms/cache/page.py. In affected versions of django CMS, whenever a client requests a page, the application executes _page_cache_key(request) to find the associated storage index. This index computation is constructed by joining the designated cache prefix, the active site primary key, the resolved language identifier, the routing path, and optional timezone details.

When a page is rendered and subsequently stored via set_page_cache, django CMS evaluates the active plugins. If a plugin registers custom headers using get_vary_cache_on(), the application correctly executes Django's native utility patch_vary_headers to attach these fields to the outbound transport headers of the HTTP response. This action tells downstream browsers and intermediary CDN edge nodes to partition their caches based on those unique header values.

Despite the outbound transport header configuration, the internal database or caching mechanism does not adapt its local write logic. The rendered page is written to the server's backend under the static, header-agnostic identifier returned by _page_cache_key(request). Because of this omission, different incoming request states mapped to the exact same database string, causing the engine to read the first generated cache variant for all subsequent visitors regardless of their actual HTTP request headers.

The vulnerable code path is characterized by a static generation model within _page_cache_key. Reviewing the original implementation demonstrates that the function lacks parameter inputs to dynamically analyze request metadata variables:

# Vulnerable implementation in cms/cache/page.py
def _page_cache_key(request):
    if hasattr(request, "LANGUAGE_CODE"):
        language = request.LANGUAGE_CODE
    else:
        language = get_language_from_request(request)
    # The generated lookup identifier is entirely blind to vary headers
    cache_key = "\%s.\%s.\%s.\%s" \% (
        settings.CMS_CACHE_PREFIX,
        site.pk,
        language,
        path,
    )
    if settings.USE_TZ:
        cache_key += ".\%s" \% get_timezone_name()
    return cache_key

The patch introduces a two-phase cache evaluation process to resolve this issue. First, a helper method _page_vary_headers_cache_key is established to retrieve the list of vary headers that have been registered for a given URL. Second, a sorting and normalization routine _vary_on_hash is introduced to create a SHA-1 hash of the active header values from the current request:

# Patched implementation in cms/cache/page.py
def _vary_on_hash(request, vary_on):
    """Computes an alphanumeric hash of specific request headers."""
    ctx = hashlib.sha1()
    for header in sorted(header.lower() for header in vary_on):
        # Standardize WSGI headers from request.META
        meta_key = "HTTP_" + header.upper().replace("-", "_")
        value = request.META.get(meta_key, "")
        ctx.update(("\%s=\%s&" \% (header, iri_to_uri(value))).encode("utf-8"))
    return ctx.hexdigest()
 
def _page_cache_key(request, vary_on=None):
    # Core identifiers are resolved here...
    cache_key += ".\%s" \% _vary_on_hash(request, vary_on or [])
    return cache_key

This two-step process provides a robust defense against namespace collisions. On cache retrieval, the application checks the metadata key first to see what headers must be analyzed. If dynamic vary headers are found, the system hashes those active values from the incoming request to locate the correct, partitioned cache entry.

Exploiting this vulnerability requires specific deployment parameters. The primary attack vector involves Web Cache Poisoning, where an attacker alters the cached representation of a page for subsequent visitors. To accomplish this, the attacker identifies a page that changes its layout or content based on a custom header, such as X-User-Segment or Country-Code.

The attacker sends a request to the target page using malicious inputs in the target header. If the plugin's template renders this input directly, the application processes the malicious data. Because the cache key ignores the header values, the server-side cache stores this customized, corrupted response under the generic cache key. Any subsequent user who requests the page receives this poisoned response.

In an alternative scenario, an attacker can exploit the vulnerability to disclose sensitive, localized information. If a regional reverse proxy routes requests using custom headers, the attacker can query the page with regional values. By doing so, the attacker can force the server to cache regional layouts or configuration data under the public static cache key, exposing it to subsequent visitors from different geographical or administrative domains.

The confidentiality impact of this vulnerability is classified as Low. While user passwords or highly sensitive session tokens are not typically exposed via this cache path, the vulnerability can disclose regional configuration data, localized information segments, or context-specific data intended for other users.

The integrity impact of the vulnerability is significant. An attacker can poison the page cache to display manipulated or unauthorized content. If the application processes and reflects custom headers unsafely, an attacker could inject malicious scripts or cross-site scripting (XSS) payloads into the cached page, compromising the security of subsequent visitors.

The vulnerability is assessed with a CVSS v3.1 base score of 4.8. The high attack complexity reflects the specific configuration requirements, as the application must have CMS_PAGE_CACHE enabled and use plugins that utilize the get_vary_cache_on() interface. Because of these specific requirements, active exploit attempts are currently limited.

The primary remediation for this vulnerability is upgrading django CMS to a patched version. Administrators should upgrade stable production environments to version 5.0.8 or newer, and development environments to version 5.1.0 or newer. These updates introduce the dual-key cache resolution workflow, ensuring vary headers are correctly evaluated.

If an immediate upgrade is not possible, administrators can mitigate the vulnerability by disabling internal page caching in the project settings file:

CMS_PAGE_CACHE = False

While disabling the cache protects the application from exploitation, it will increase database query volume and CPU usage on the application server. Administrators should monitor system performance closely if caching is disabled.

Additionally, administrators can configure upstream reverse proxies or CDNs to strip or sanitize custom headers from untrusted clients before the requests reach the application server. This prevents attackers from injecting custom values that could poison the cache.