@@ -221,11 +221,15 @@ def get_prep_value(self, value):
                 try:
                     obj = GEOSGeometry(obj, max_geom_collections=max_geom_collections)
                 except (TypeError, ValueError) as err:
-                    if isinstance(obj, str) and obj.startswith(VSI_FILESYSTEM_PREFIX):
+                    if isinstance(obj, bytes) or (
+                        isinstance(obj, str) and obj.startswith(VSI_FILESYSTEM_PREFIX)
+                    ):
                         raise blocked_err
                     raise err
                 except (GEOSException, GDALException):
-                    if isinstance(obj, str) and json_regex.match(obj):
+                    if isinstance(obj, bytes) or (
+                        isinstance(obj, str) and json_regex.match(obj)
+                    ):
                         raise blocked_err
                     raise ValueError(
                         "Couldn't create spatial object from lookup value '%s'." % obj
 
@@ -34,8 +34,8 @@
 
 class DisallowedRasterLookup(SuspiciousOperation):
     """
-    Types that force GDALRaster to open in write mode (dict) or values that
-    could be virtual filesystem paths (str) are not allowed in lookup contexts.
+    Types that force GDALRaster to open in write mode or values that could
+    reference external sources, are not allowed in lookup contexts.
     Instead, wrap values in GDALRaster explicitly.
     """
 
@@ -249,12 +249,19 @@ def check_raster_lookup_value(cls, ds_input):
         """
         Raise DisallowedRasterLookup for values inappropriate in lookups:
         - No dicts, which GDALRaster(write=False) might still write to.
-        - No strings or Paths, which might fetch over the virtual filesystem.
+        - No strings, bytes, or Paths, which might fetch over the virtual
+          filesystem.
         """
         normalized = cls._preprocess_input(ds_input)
-        if isinstance(normalized, (dict, str)):
+        if isinstance(normalized, (dict, str, bytes)):
+            value_repr = repr(normalized)
+            if len(value_repr) > 4096:
+                value_repr = "%s… <trimmed %d bytes string>" % (
+                    value_repr[:4096],
+                    len(value_repr),
+                )
             msg = (
-                f"Cannot use object {normalized!r} for a spatial lookup "
+                f"Cannot use object {value_repr} for a spatial lookup "
                 "parameter. If this is a raster, wrap it with GDALRaster() "
                 "before using it in a lookup to enable writing or fetching."
             )
 
@@ -149,10 +149,10 @@ Filters on 'normal' fields (e.g. :class:`~django.db.models.CharField`)
 may be chained with those on geographic fields. Geographic lookups accept
 geometry and raster input on both sides, and input types can be mixed freely in
 most cases. However, unlike assignments to model fields, with lookups,
-types such as ``str``, :class:`pathlib.Path`, and ``dict`` must be wrapped by
-:class:`~django.contrib.gis.gdal.GDALRaster` to signify that the potential for
-file writing or network fetching is acceptable. For the rationale, see
-:ref:`raster security considerations <raster-security>`.
+types such as ``bytes``, ``str``, :class:`pathlib.Path`, and ``dict`` must be
+wrapped by :class:`~django.contrib.gis.gdal.GDALRaster` to signify that the
+potential for file writing or network fetching is acceptable. For the
+rationale, see :ref:`raster security considerations <raster-security>`.
 
 The general structure of geographic lookups is described below. A complete
 reference can be found in the :ref:`spatial lookup reference<spatial-lookups>`.
 
@@ -2089,6 +2089,13 @@ Here's how to create a raster and return it as a file in an
     ... )
     >>> HttpResponse(rast.vsi_buffer, "image/tiff")
 
+.. warning::
+
+    The memory-based virtual filesystem doesn't make untrusted raster data
+    safe. Raster data may reference local or remote resources, for example
+    through a VRT source, causing GDAL to access files or make network
+    requests. Only instantiate :class:`GDALRaster` from trusted input.
+
 Using other Virtual Filesystems
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -2150,17 +2157,14 @@ essential to prevent instantiating one from untrusted input. Otherwise, an
 attacker might gain the ability to write a file or make a network request.
 
 To mitigate this, :ref:`spatial lookups <spatial-lookups-intro>` prevent
-``str``, :class:`pathlib.Path`, and ``dict`` values from reaching
+``bytes``, ``str``, :class:`pathlib.Path`, and ``dict`` values from reaching
 :class:`GDALRaster` altogether. To use these types with lookups, wrap them
 explicitly with :class:`GDALRaster`, indicating that the value is trusted.
-Bytes are accepted without being wrapped in :class:`GDALRaster` because they
-are opened through GDAL's memory-based :ref:`virtual filesystem
-<gdal-raster-vsimem>`.
-
-This protection applies only to spatial lookups. Assigning a ``dict`` value to
-a :class:`~django.contrib.gis.db.models.RasterField` will still open a new
-raster, and assigning a ``str`` or ``Path`` will still fetch and open the
-referenced raster.
+
+This protection applies only to spatial lookups. Assigning a ``dict`` or
+``bytes`` value to a :class:`~django.contrib.gis.db.models.RasterField` will
+still open a new raster, and assigning a ``str`` or ``Path`` will still fetch
+and open the referenced raster.
 
 When validating geometry inputs, the
 :class:`~django.contrib.gis.forms.GeometryField` form field will reject raster
 
@@ -41,6 +41,30 @@ of some malformed or unusual header values may differ, for example,
 This issue has severity "moderate" according to the :ref:`Django security
 policy <severity-levels>`.
 
+CVE-2026-87890: Potential request forgery via spatial lookup byte values
+========================================================================
+
+Spatial lookups accepted raster values provided as ``bytes`` without requiring
+them to be explicitly wrapped in :class:`~django.contrib.gis.gdal.GDALRaster`.
+Although these values were opened through GDAL's in-memory virtual filesystem,
+they could contain a VRT document referencing an external raster source. This
+could cause GDAL to issue network requests as the Django process user while
+preparing the lookup.
+
+This issue could be exploited by applications that passed attacker-controlled
+bytes directly to a spatial lookup. It was overlooked in the fix for
+CVE-2026-15307.
+
+To mitigate this issue, raster values provided as ``bytes`` must now be wrapped
+in :class:`~django.contrib.gis.gdal.GDALRaster` before being used in spatial
+lookups. Byte values representing valid hexadecimal geometries remain accepted.
+
+This is a backward incompatible change. As a reminder, all untrusted user input
+should be validated before use.
+
+This issue has severity "moderate" according to the :ref:`Django security
+policy <severity-levels>`.
+
 Bugfixes
 ========
 
 
@@ -41,6 +41,30 @@ of some malformed or unusual header values may differ, for example,
 This issue has severity "moderate" according to the :ref:`Django security
 policy <severity-levels>`.
 
+CVE-2026-87890: Potential request forgery via spatial lookup byte values
+========================================================================
+
+Spatial lookups accepted raster values provided as ``bytes`` without requiring
+them to be explicitly wrapped in :class:`~django.contrib.gis.gdal.GDALRaster`.
+Although these values were opened through GDAL's in-memory virtual filesystem,
+they could contain a VRT document referencing an external raster source. This
+could cause GDAL to issue network requests as the Django process user while
+preparing the lookup.
+
+This issue could be exploited by applications that passed attacker-controlled
+bytes directly to a spatial lookup. It was overlooked in the fix for
+CVE-2026-15307.
+
+To mitigate this issue, raster values provided as ``bytes`` must now be wrapped
+in :class:`~django.contrib.gis.gdal.GDALRaster` before being used in spatial
+lookups. Byte values representing valid hexadecimal geometries remain accepted.
+
+This is a backward incompatible change. As a reminder, all untrusted user input
+should be validated before use.
+
+This issue has severity "moderate" according to the :ref:`Django security
+policy <severity-levels>`.
+
 Bugfixes
 ========
 
 
@@ -42,6 +42,30 @@ of some malformed or unusual header values may differ, for example,
 This issue has severity "moderate" according to the :ref:`Django security
 policy <severity-levels>`.
 
+CVE-2026-87890: Potential request forgery via spatial lookup byte values
+========================================================================
+
+Spatial lookups accepted raster values provided as ``bytes`` without requiring
+them to be explicitly wrapped in :class:`~django.contrib.gis.gdal.GDALRaster`.
+Although these values were opened through GDAL's in-memory virtual filesystem,
+they could contain a VRT document referencing an external raster source. This
+could cause GDAL to issue network requests as the Django process user while
+preparing the lookup.
+
+This issue could be exploited by applications that passed attacker-controlled
+bytes directly to a spatial lookup. It was overlooked in the fix for
+CVE-2026-15307.
+
+To mitigate this issue, raster values provided as ``bytes`` must now be wrapped
+in :class:`~django.contrib.gis.gdal.GDALRaster` before being used in spatial
+lookups. Byte values representing valid hexadecimal geometries remain accepted.
+
+This is a backward incompatible change. As a reminder, all untrusted user input
+should be validated before use.
+
+This issue has severity "moderate" according to the :ref:`Django security
+policy <severity-levels>`.
+
 Bugfixes
 ========
 
 
@@ -749,10 +749,9 @@ def test_lookup_rejects_writing_or_fetching_rasters(self):
         - strings matching a json regex
         - bytes
 
-        Since this could be unexpected in a lookup context, disallow dicts
-        and strings: instead, explicitly wrap with GDALRaster() to signal that
-        a write or fetch is expected. Bytes only write to the in-memory virtual
-        filesystem, so allow them.
+        Since this could be unexpected in a lookup context, disallow dicts,
+        bytes, and strings: instead, explicitly wrap with GDALRaster() to
+        signal that a write or fetch is expected.
 
         Disallowing strings also disallows paths to local or network rasters,
         but those didn't work in the lookup context anyway, since they were
@@ -790,23 +789,18 @@ def test_lookup_rejects_writing_or_fetching_rasters(self):
             "/vsis3/someurl",
             vsimem_path,
             existing_path,
+            existing_path.read_bytes(),
+            b"POINT (invalid)",
         ]
         for obj in disallowed_cases:
-            try:
-                msg_obj = json.loads(obj)
-            except Exception:
-                if isinstance(obj, Path):
-                    msg_obj = str(obj)
-                else:
-                    msg_obj = obj
             msg = (
-                f"Cannot use object {msg_obj!r} for a spatial lookup parameter. "
-                "If this is a raster, wrap it with GDALRaster() before using "
-                "it in a lookup to enable writing or fetching."
+                r"Cannot use object .* for a spatial lookup parameter\. If "
+                r"this is a raster, wrap it with GDALRaster\(\) before using "
+                r"it in a lookup to enable writing or fetching\."
             )
             with (
                 self.subTest(obj=obj),
-                self.assertRaisesMessage(DisallowedRasterLookup, msg),
+                self.assertRaisesRegex(DisallowedRasterLookup, msg),
             ):
                 State.objects.filter(poly__intersects=obj)
 
@@ -816,12 +810,14 @@ def test_lookup_rejects_writing_or_fetching_rasters(self):
             with self.subTest(obj=obj), self.assertRaisesMessage(ValueError, msg):
                 State.objects.filter(poly__intersects=obj)
 
-    def test_lookup_allows_writing_raster_from_bytes(self):
-        raster_path = Path(__file__).parent.parent / "data" / "rasters" / "raster.tif"
-        with open(raster_path, "rb") as raster_file:
-            raster_bytes = raster_file.read()
-        # Just get SQL to avoid gating on connection.supports_raster.
-        State.objects.filter(poly__intersects=raster_bytes).query
+    def test_lookup_rejected_value_repr_is_truncated(self):
+        value = b"x" * 5000
+        with self.assertRaises(DisallowedRasterLookup) as ctx:
+            State.objects.filter(poly__intersects=value)
+
+        message = str(ctx.exception)
+        self.assertIn("… <trimmed 5003 bytes string>", message)
+        self.assertNotIn("x" * 4097, message)
 
     def test_lookup_allows_geos_geometry_string(self):
         geojson = json.dumps({"type": "Point", "coordinates": [2, 49]})