CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13372?
CVE-2025-13372 has been classified as a high-severity SQL injection vulnerability affecting specific versions of Django.
How do I fix CVE-2025-13372?
To mitigate CVE-2025-13372, upgrade Django to version 5.2.9, 5.1.15, or 4.2.27 or later.
What versions of Django are affected by CVE-2025-13372?
CVE-2025-13372 affects Django versions before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
What type of vulnerability is CVE-2025-13372?
CVE-2025-13372 is an SQL injection vulnerability that occurs in the FilteredRelation due to improper handling of column aliases.
Can CVE-2025-13372 lead to unauthorized data access?
Yes, CVE-2025-13372 can potentially allow attackers to execute arbitrary SQL commands, leading to unauthorized data access.