CVE catalog

CVE-2025-48432

Django vulnerability

[CVE catalog]

Severity
Medium · CVSS 6.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.75% · Oct 25, 2026

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython-djangosid3:5.2.18-1fixed
Debianpython-djangoforky3:5.2.17-2fixed
Debianpython-djangotrixie3:4.2.28-0+deb13u2fixed
Debianpython-djangotrixie-security3:4.2.28-0+deb13u1fixed
Debianpython-djangobookworm3:3.2.25-0+deb12u3fixed
Debianpython-djangobookworm-security3:3.2.25-0+deb12u6fixed
Ubuntupython-djangonoble3:4.2.11-1ubuntu1.8fixed
Ubuntupython-django-docnoble3:4.2.11-1ubuntu1.8fixed
Ubuntupython3-djangonoble3:4.2.11-1ubuntu1.8fixed
PyPIdjangoNot reported4.2.22fixed
PyPIdjangoNot reported5.1.10fixed
PyPIdjangoNot reported4.2.22fixed
Ubuntupython-djangopro1:1.11.22-1ubuntu1vulnerable
Ubuntupython-djangopro2:2.2.6-1ubuntu1vulnerable
Ubuntupython-djangopro2:2.2.9-2ubuntu1vulnerable
Ubuntupython-djangopro2:2.2.10-1vulnerable
Ubuntupython-djangopro2:2.2.10-1ubuntu1vulnerable
Ubuntupython-djangopro2:2.2.11-1vulnerable
Ubuntupython-djangopro2:2.2.12-1vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.1vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.2vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.3vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.4vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.5vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.6vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.7vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.8vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.9vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.10vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.11vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.12vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.13vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.14vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.15vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.16vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.17vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.18vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.19vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.20vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.21vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.22vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.23vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.24vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.25vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.26vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.27vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.28vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.29vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.29+esm1vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.29+esm2fixed
Ubuntupython-django22.042:2.2.24-1ubuntu1vulnerable
Ubuntupython-django22.042:3.2.12-2vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.1vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.2vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.3vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.4vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.5vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.6vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.7vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.8vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.9vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.10vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.11vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.12vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.13vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.14vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.15vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.16vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.17vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.18vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.19vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.20fixed
Ubuntupython-django24.043:4.2.4-1ubuntu2vulnerable
Ubuntupython-django24.043:4.2.8-1vulnerable
Ubuntupython-django24.043:4.2.9-1vulnerable
Ubuntupython-django24.043:4.2.11-1vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.1vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.2vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.3vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.4vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.5vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.6vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.7vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.8vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.9fixed
Ubuntupython-django25.103:4.2.18-1ubuntu1vulnerable
Ubuntupython-django25.103:4.2.18-1ubuntu1.1vulnerable
Ubuntupython-django25.103:5.2.4-1fixed
Ubuntupython-djangopro1:1.11.22-1ubuntu1vulnerable
Ubuntupython-djangopro2:2.2.6-1ubuntu1vulnerable
Ubuntupython-djangopro2:2.2.9-2ubuntu1vulnerable
Ubuntupython-djangopro2:2.2.10-1vulnerable
Ubuntupython-djangopro2:2.2.10-1ubuntu1vulnerable
Ubuntupython-djangopro2:2.2.11-1vulnerable
Ubuntupython-djangopro2:2.2.12-1vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.1vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.2vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.3vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.4vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.5vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.6vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.7vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.8vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.9vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.10vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.11vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.12vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.13vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.14vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.15vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.16vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.17vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.18vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.19vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.20vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.21vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.22vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.23vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.24vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.25vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.26vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.27vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.28vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.29vulnerable
Ubuntupython-djangopro2:2.2.12-1ubuntu0.29+esm1fixed
Ubuntupython-django22.042:2.2.24-1ubuntu1vulnerable
Ubuntupython-django22.042:3.2.12-2vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.1vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.2vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.3vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.4vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.5vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.6vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.7vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.8vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.9vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.10vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.11vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.12vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.13vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.14vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.15vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.16vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.17vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.18vulnerable
Ubuntupython-django22.042:3.2.12-2ubuntu1.19fixed
Ubuntupython-django24.043:4.2.4-1ubuntu2vulnerable
Ubuntupython-django24.043:4.2.8-1vulnerable
Ubuntupython-django24.043:4.2.9-1vulnerable
Ubuntupython-django24.043:4.2.11-1vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.1vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.2vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.3vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.4vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.5vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.6vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.7vulnerable
Ubuntupython-django24.043:4.2.11-1ubuntu1.8fixed
Opensusepython-Django4tumbleweed4.2.22-1.1fixed
Opensusepython-Djangotumbleweed5.2.2-1.1fixed
Susepython-Djangolinux enterprise module for package hub 15 sp64.2.11-150600.3.27.1fixed
Susepython-Djangolinux enterprise module for package hub 15 sp74.2.11-150600.3.27.1fixed
Opensusepython-Djangoleap 15.64.2.11-150600.3.27.1fixed
Susepython-Djangolinux enterprise module for package hub 15 sp64.2.11-150600.3.24.1fixed
Susepython-Djangolinux enterprise module for package hub 15 sp74.2.11-150600.3.24.1fixed
Opensusepython-Djangoleap 15.64.2.11-150600.3.24.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython-djangosourcesid3:4.2.23-1not yet assignedNot reported[1107282]
Debianpython-djangosourceforky3:4.2.23-1not yet assignedNot reported[1107282]
Debianpython-djangosourcetrixie3:4.2.23-1not yet assignedNot reported[1107282]
Debianpython-djangosourcebookworm3:3.2.25-0+deb12u1not yet assignedNot reported[1107282]
Ubuntupython-djangodebnoble3:4.2.11-1ubuntu1.8Not reportedNot reportedNot reported
Ubuntupython-django-docdebnoble3:4.2.11-1ubuntu1.8Not reportedNot reportedNot reported
Ubuntupython3-djangodebnoble3:4.2.11-1ubuntu1.8Not reportedNot reportedNot reported
PyPIdjangoPyPINot reported4.2.22Not reportedGHSA-7XR5-9HCQ-CHF9Not reported
PyPIdjangoPyPINot reported5.1.10Not reportedNot reportedNot reported
PyPIdjangoPyPINot reported4.2.22Not reportedNot reportedNot reported
Ubuntupython-djangodebpro2:2.2.12-1ubuntu0.29+esm2Not reportedUBUNTU-CVE-2025-48432Not reported
Ubuntupython-djangodeb22.042:3.2.12-2ubuntu1.20Not reportedUBUNTU-CVE-2025-48432Not reported
Ubuntupython-djangodeb24.043:4.2.11-1ubuntu1.9Not reportedUBUNTU-CVE-2025-48432Not reported
Ubuntupython-djangodeb25.103:5.2.4-1Not reportedUBUNTU-CVE-2025-48432Not reported
Ubuntupython-djangodebpro2:2.2.12-1ubuntu0.29+esm1Not reportedUSN-7555-1Not reported
Ubuntupython-djangodeb22.042:3.2.12-2ubuntu1.19Not reportedUSN-7555-1Not reported
Ubuntupython-djangodeb24.043:4.2.11-1ubuntu1.8Not reportedUSN-7555-1Not reported
Opensusepython-Django4rpmtumbleweed4.2.22-1.1Not reportedOPENSUSE-SU-2025:15268-1Not reported
Opensusepython-Djangorpmtumbleweed5.2.2-1.1Not reportedOPENSUSE-SU-2025:15267-1Not reported
Susepython-Djangorpmlinux enterprise module for package hub 15 sp64.2.11-150600.3.27.1Not reportedSUSE-SU-2025:02248-1Not reported
Susepython-Djangorpmlinux enterprise module for package hub 15 sp74.2.11-150600.3.27.1Not reportedSUSE-SU-2025:02248-1Not reported
Opensusepython-Djangorpmleap 15.64.2.11-150600.3.27.1Not reportedSUSE-SU-2025:02248-1Not reported
Susepython-Djangorpmlinux enterprise module for package hub 15 sp64.2.11-150600.3.24.1Not reportedSUSE-SU-2025:01952-1Not reported
Susepython-Djangorpmlinux enterprise module for package hub 15 sp74.2.11-150600.3.24.1Not reportedSUSE-SU-2025:01952-1Not reported
Opensusepython-Djangorpmleap 15.64.2.11-150600.3.24.1Not reportedSUSE-SU-2025:01952-1Not reported

[Debian bug #1107282]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • Source package: [python-Django]

    Details (1)
    • 6.0.8-1.1 · noarch · tumbleweed

      Unknown · Fixed: 5.2.2-1.1

      Version impact unknown

      usn · python-Django · opensuse · tumbleweed

  • Source package: [python-Django4]

    Details (1)
    • 4.2.30-5.1 · noarch · tumbleweed

      Unknown · Fixed: 4.2.22-1.1

      Version impact unknown

      usn · python-Django4 · opensuse · tumbleweed

  • Source package: [python-Django]

    Details (1)
    • 6.0.8-1.1 · noarch · tumbleweed

      Unknown · Fixed: 5.2.2-1.1

      Version impact unknown

      usn · python-Django · opensuse · tumbleweed

  • Source package: [python-Django4]

    Details (1)
    • 4.2.30-5.1 · noarch · tumbleweed

      Unknown · Fixed: 4.2.22-1.1

      Version impact unknown

      usn · python-Django4 · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • Source package: [python-django]

    Details (6)
    • 3:3.2.25-0+deb12u3 · all · bookworm

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:3.2.25-0+deb12u3 · all · bookworm

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:4.2.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:4.2.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:3.2.25-0+deb12u4 · all · bookworm-security

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:3.2.25-0+deb12u4 · all · bookworm-security

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

  • Source package: [python-django]

    Details (6)
    • 3:3.2.25-0+deb12u3 · all · bookworm

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:3.2.25-0+deb12u3 · all · bookworm

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:4.2.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:4.2.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:3.2.25-0+deb12u4 · all · bookworm-security

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

    • 3:3.2.25-0+deb12u4 · all · bookworm-security

      Fixed · Fixed: 3:3.2.25-0+deb12u1

      usn · python-django · debian · bookworm; usn · python-django · debian · 12

[Debian 13 (Trixie)]

  • Source package: [python-django]

    Details (6)
    • 3:4.2.28-0+deb13u2 · all · trixie

      Fixed · Fixed: 3:4.2.23-1

      usn · python-django · debian · 13

    • 3:4.2.28-0+deb13u2 · all · trixie

      Fixed · Fixed: 3:4.2.23-1

      usn · python-django · debian · 13

    • 3:5.2.16-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 3:4.2.23-1

      usn · python-django · debian · 13

    • 3:5.2.16-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 3:4.2.23-1

      usn · python-django · debian · 13

    • 3:4.2.28-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 3:4.2.23-1

      usn · python-django · debian · 13

    • 3:4.2.28-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 3:4.2.23-1

      usn · python-django · debian · 13

  • Source package: [python-django]

    Details (6)
    • 3:4.2.28-0+deb13u2 · all · trixie

      Fixed · Fixed: 3:4.2.23-1

      usn · python-django · debian · 13

    • 3:4.2.28-0+deb13u2 · all · trixie

      Fixed · Fixed: 3:4.2.23-1

      usn · python-django · debian · 13

    • 3:5.2.16-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 3:4.2.23-1

      usn · python-django · debian · 13

    • 3:5.2.16-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 3:4.2.23-1

      usn · python-django · debian · 13

    • 3:4.2.28-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 3:4.2.23-1

      usn · python-django · debian · 13

    • 3:4.2.28-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 3:4.2.23-1

      usn · python-django · debian · 13

Observed:

References