Skip to content
OpenAdvisories
High DLA-4324-1 2 CVEs

python-django - security update

Published Oct 7, 2025 · Updated Oct 7, 2025

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 python-django 2:2.2.28-1~deb11u9

Vulnerabilities 2

  • High 7.1
    CVE-2025-59681

    Django vulnerable to SQL injection in column aliases

    An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dicti…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • Low 3.1
    CVE-2025-59682

    Django vulnerable to partial directory traversal via archives

    An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an arch…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI