CVE-2025-48432

NameCVE-2025-48432
DescriptionAn issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4210-1
Debian Bugs1107282, 1107616

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-django (PTS)bullseye2:2.2.28-1~deb11u2vulnerable
bullseye (security)2:2.2.28-1~deb11u7fixed
bookworm, bookworm (security)3:3.2.19-1+deb12u1vulnerable
sid, trixie3:4.2.23-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-djangosourcebullseye2:2.2.28-1~deb11u7DLA-4210-1
python-djangosource(unstable)3:4.2.23-11107282, 1107616

Notes

https://www.djangoproject.com/weblog/2025/jun/04/security-releases/
Fixed by: https://github.com/django/django/commit/ac03c5e7df8680c61cdb0d3bdb8be9095dba841e (4.2.22)
Initial 4.2.22 release didn't fix it fully: https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases/
Follow up: https://github.com/django/django/commit/b597d46bb19c8567615e62029210dab16c70db7d (4.2.23)

Search for package or bug name: Reporting problems