CVE-2025-48432: Django: Potential log injection via unescaped quest path

Q: What is the severity of CVE-2025-48432?

CVE-2025-48432 is considered a medium severity vulnerability due to potential log injection or forgery risks.

Q: How do I fix CVE-2025-48432?

To fix CVE-2025-48432, upgrade to Django versions 5.2.2, 5.1.10, or 4.2.22 or later.

Q: What types of attacks can CVE-2025-48432 enable?

CVE-2025-48432 can enable attacks such as log injection and forgery through crafted URLs.

Q: Which versions of Django are affected by CVE-2025-48432?

CVE-2025-48432 affects Django versions prior to 5.2.2, 5.1.10, and 4.2.22.

Q: Is user authentication affected by CVE-2025-48432?

CVE-2025-48432 primarily affects internal HTTP response logging and does not directly impact user authentication.

Published Jun 4, 2025

Updated

An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

Other sources

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

— NVD

Affected Software

15 affected componentsFixes available

Django Django<5.2.2

Django Django<5.1.10

Django Django<4.2.22

pip/django<4.2.22

4.2.22

pip/django>=5.0a1<5.1.10

5.1.10

pip/django>=5.2<5.2.2

5.2.2

djangoproject Django>=4.2<4.2.23

djangoproject Django>=5.1<5.1.11

djangoproject Django>=5.2<5.2.3

Debian Debian Linux=11.0

alpine/py3-django<4.2.22-r0

4.2.22-r0

alpine/py3-django<4.2.22-r0

4.2.22-r0

alpine/py3-django<4.2.22-r0

4.2.22-r0

alpine/py3-django<4.2.22-r0

4.2.22-r0

debian/python-django

3:3.2.25-0+deb12u33:3.2.25-0+deb12u63:4.2.28-0+deb13u23:4.2.28-0+deb13u13:5.2.17-23:5.2.19-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/Django to a version that resolves this vulnerability.
Fixed in 4.2.22
Upgrade
Upgrade pip/Django to a version that resolves this vulnerability.
Fixed in 5.1.10
Upgrade
Upgrade pip/Django to a version that resolves this vulnerability.
Fixed in 5.2.2
Upgrade
Upgrade alpine/py3-django to a version that resolves this vulnerability.
Fixed in 4.2.22-r0
Upgrade
Upgrade debian/python-django to a version that resolves this vulnerability.
Fixed in 3:3.2.25-0+deb12u3Fixed in 3:3.2.25-0+deb12u6Fixed in 3:4.2.28-0+deb13u2Fixed in 3:4.2.28-0+deb13u1Fixed in 3:5.2.17-2Fixed in 3:5.2.19-1
Upgrade
Upgrade Django to a version that resolves this vulnerability.
Fixed in 5.2.3
Upgrade
Upgrade Django to a version that resolves this vulnerability.
Fixed in 5.1.11
Upgrade
Upgrade Django to a version that resolves this vulnerability.
Fixed in 4.2.23

Event History

Jun 5, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Data Sourced

via Red Hat·03:01 AM

DescriptionSeverityAffected Software

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·03:15 AM

DescriptionSeverityAffected Software

Advisory Published

via GitHub·03:30 AM

Data Sourced

via GitHub·03:30 AM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-6136

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4210-1

Frequently Asked Questions

What is the severity of CVE-2025-48432?

CVE-2025-48432 is considered a medium severity vulnerability due to potential log injection or forgery risks.

How do I fix CVE-2025-48432?

To fix CVE-2025-48432, upgrade to Django versions 5.2.2, 5.1.10, or 4.2.22 or later.

What types of attacks can CVE-2025-48432 enable?

CVE-2025-48432 can enable attacks such as log injection and forgery through crafted URLs.

Which versions of Django are affected by CVE-2025-48432?

CVE-2025-48432 affects Django versions prior to 5.2.2, 5.1.10, and 4.2.22.

Is user authentication affected by CVE-2025-48432?

CVE-2025-48432 primarily affects internal HTTP response logging and does not directly impact user authentication.

CVE-2025-48432: Django: Potential log injection via unescaped quest path

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2025-48432?

How do I fix CVE-2025-48432?

What types of attacks can CVE-2025-48432 enable?

Which versions of Django are affected by CVE-2025-48432?

Is user authentication affected by CVE-2025-48432?

Company

Resources

Contact