CVE-2025-48432: Django: Potential log injection via unescaped quest path
An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.
Other sources
An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48432?
CVE-2025-48432 is considered a medium severity vulnerability due to potential log injection or forgery risks.
How do I fix CVE-2025-48432?
To fix CVE-2025-48432, upgrade to Django versions 5.2.2, 5.1.10, or 4.2.22 or later.
What types of attacks can CVE-2025-48432 enable?
CVE-2025-48432 can enable attacks such as log injection and forgery through crafted URLs.
Which versions of Django are affected by CVE-2025-48432?
CVE-2025-48432 affects Django versions prior to 5.2.2, 5.1.10, and 4.2.22.
Is user authentication affected by CVE-2025-48432?
CVE-2025-48432 primarily affects internal HTTP response logging and does not directly impact user authentication.