Summary
It was discovered that Django incorrectly handled special characters in the
QuerySet function calls. A remote attacker could possibly use this issue to
perform SQL injection attacks. (CVE-2025-59681)
It was discovered that Django incorrectly handled files with the same path
prefix when starting with a template. An attacker could possibly use this
issue to obtain sensitive information. (CVE-2025-59682)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | python-django | 2:3.2.12-2ubuntu1.22 |
| Ubuntu · 24.04 LTS 24.04:LTS | python-django | 3:4.2.11-1ubuntu1.11 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | python-django | 1.6.11-0ubuntu1.3+esm8 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python-django | 1.8.7-1ubuntu5.15+esm9 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python-django | 1:1.11.11-1ubuntu1.21+esm12 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python-django | 2:2.2.12-1ubuntu0.29+esm4 |
Vulnerabilities 2
-
High 7.1
Django vulnerable to SQL injection in column aliases
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dicti…
-
Low 3.1
Django vulnerable to partial directory traversal via archives
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an arch…