Skip to content
OpenAdvisories
Medium USN-7555-1 1 CVE

python-django vulnerability

Published Jun 4, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Django incorrectly handled certain
unescaped request paths. An attacker could possibly use this
issue to perform a log injection.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS python-django 2:3.2.12-2ubuntu1.19
Ubuntu · 24.04 LTS 24.04:LTS python-django 3:4.2.11-1ubuntu1.8
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS python-django 2:2.2.12-1ubuntu0.29+esm1

Vulnerabilities 1

  • Medium 4.0
    CVE-2025-48432

    Django Improper Output Neutralization for Logs vulnerability

    An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to lo…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2025-48432