CVE-2025-48432

NameCVE-2025-48432
DescriptionAn issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4210-1
Debian Bugs1107282

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-django (PTS)bullseye2:2.2.28-1~deb11u2vulnerable
bullseye (security)2:2.2.28-1~deb11u7fixed
bookworm, bookworm (security)3:3.2.19-1+deb12u1vulnerable
trixie3:4.2.21-1vulnerable
sid3:4.2.22-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-djangosourcebullseye2:2.2.28-1~deb11u7DLA-4210-1
python-djangosource(unstable)3:4.2.22-11107282

Notes

https://www.djangoproject.com/weblog/2025/jun/04/security-releases/
Fixed by: https://github.com/django/django/commit/ac03c5e7df8680c61cdb0d3bdb8be9095dba841e (4.2.22)

Search for package or bug name: Reporting problems