Django Improper Output Neutralization for Logs vulnerability
RSS Feed
MODERATE
GHSA-7xr5-9hcq-chf9
CVE-2025-48432
Description:
An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.
Affected Packages
| Ecosystem | Package | Vulnerable Versions | Patched Version |
|---|---|---|---|
| pypi |
Django
|
< 4.2.22>= 5.0a1, < 5.1.10>= 5.2, < 5.2.2 |
4.2.22
|
Bump django from 3.2.18 to 4.2.24 in /web
Open about 1 year ago
icbi-lab/mio #11
pip:django
Bump django from 4.2.16 to 4.2.24
Open about 1 year ago
ferdle-org/dependabot-python-test #5
pip:django
Bump django from 4.1.13 to 4.2.24
Closed about 1 year ago
Jawwad-Fida/HealthStack-System #524
pip:django
build(deps): Bump django from 4.2.23 to 4.2.24 in /backend
Closed about 1 year ago
Bryvn01/EasyCart #45
pip:django
Bump django from 4.2.23 to 4.2.24
Open about 1 year ago
daveisfera/celery_cold_shutdown #20
pip:django
Bump django from 4.2.14 to 4.2.24
Merged about 1 year ago
luismdp05/sistema-gestion-academica #5
pip:django
Bump django from 4.2.22 to 4.2.24 in /ML-Models/Heart-Disease-Classification
Open about 1 year ago
avinashkranjan/lifeMEDeasy #952
pip:django
Bump django from 4.2.16 to 4.2.24
Closed about 1 year ago
alff0x1f/kolco24 #108
pip:django
Bump django from 4.2.23 to 4.2.24
Open about 1 year ago
Open-Source-Legal/OpenContracts #484
pip:django
Bump django from 2.0.5 to 4.2.24
Closed about 1 year ago
mark-graciov/battleship #2
pip:django
Bump django from 3.2.25 to 4.2.24
Open about 1 year ago
CVEDB/reconPoint #13
pip:django
Bump django from 2.2.6 to 4.2.24
Open about 1 year ago
creamsandwch/hw03_forms #2
pip:django
Bump django from 2.2.19 to 4.2.24 in /yatube
Merged about 1 year ago
creamsandwch/hw02_community #1
pip:django
Bump django from 2.2.19 to 4.2.24 in /yatube
Merged about 1 year ago
creamsandwch/hw03_forms #1
pip:django
Bump django from 5.1.9 to 5.1.12
Merged about 1 year ago
EdinsonRequena/tiktok-backend-clone #26
pip:django
Bump django from 4.2.8 to 4.2.24
Closed about 1 year ago
21toffy/newsapi #11
pip:django
Bump django from 3.2.25 to 4.2.24
Open about 1 year ago
zaymuel/project-manager #21
pip:django
Bump django from 4.2.22 to 4.2.24 in /api_yamdb
Merged about 1 year ago
themasterid/infra_sp2 #14
pip:django
Bump the all-python-dependencies group across 1 directory with 9 updates
Closed about 1 year ago
jaydonkrooss/my-learning-analytics #14
pip:pandas
pip:django
+7 more
build(deps): bump django from 4.2.3 to 4.2.24
Open about 1 year ago
alisson-vml/crud_django_pokedex #1
pip:django
Bump django from 5.0.14 to 5.1.12 in /backend
Merged about 1 year ago
aayushker/Shhh #18
pip:django
Bump the all-python-dependencies group across 1 directory with 9 updates
Open about 1 year ago
tl-its-umich-edu/my-learning-analytics #1677
pip:pandas
pip:django
+7 more
Bump django from 5.0.6 to 5.1.12
Open about 1 year ago
Fahimun/ready #1
pip:django
Bump django from 5.1.2 to 5.1.12 in /projects/gcom-2025
Open about 1 year ago
ubc-uas/gcom #5
pip:django
Bump django from 4.0.2 to 4.2.24
Closed about 1 year ago
TheGhostAlmas/form_clone #7
pip:django
Bump django from 3.2.25 to 4.2.24
Merged about 1 year ago
vankhaiphan/vietnamdonationfoundation #14
pip:django
chore(deps): bump the dependencies group across 3 directories with 26 updates
Open about 1 year ago
amanning3390/PSI-Inventory #12
pip:mkdocs-material
pip:mkdocstrings
+4 more
chore(deps): bump the dependencies group across 3 directories with 19 updates
Closed about 1 year ago
sahil-vakte/inventory-management-system #7
pip:django
pip:coverage
+12 more
deps: bump django from 2.2.28 to 4.2.24
Open about 1 year ago
BuildingSync/BuildingSync-website #201
pip:django
chore(deps): bump the dependencies group across 3 directories with 19 updates
Open about 1 year ago
Themoffyn/InvenTree-personal #10
pip:django
pip:coverage
+12 more
Bump django from 5.1.3 to 5.1.12 in /birds_nest
Closed about 1 year ago
eclipse-efbt/efbt #1712
pip:django
Bump the python-packages group across 1 directory with 21 updates
Open about 1 year ago
nycnoise/nycnoise #563
pip:mypy
pip:boto3
+19 more
chore(deps): bump the dependencies group across 3 directories with 19 updates
Open about 1 year ago
galinagl0/inventree #9
pip:django
pip:coverage
+12 more
chore(deps): bump the dependencies group across 3 directories with 19 updates
Closed about 1 year ago
VictorReOr/inventario-deportivo #9
pip:django
pip:coverage
+12 more
chore(deps): bump the python-minor-patch group across 2 directories with 7 updates
Open about 1 year ago
nordic-institute/X-Road-Metrics #191
pip:setuptools
pip:django
+5 more
Bump django from 4.2.10 to 4.2.24 in /InformationService
Open about 1 year ago
loraAbramchuk/DiplomTeachMeSkills #1
pip:django
Bump django from 4.2.22 to 4.2.24 in /Python/Django/app
Open about 1 year ago
AngeloRafael02/Self_Archives #229
pip:django
Bump django from 4.2.23 to 4.2.24
Merged about 1 year ago
baseplate-admin/django-hstore-widget #309
pip:django
Chore(deps): Bump django from 4.0.10 to 4.2.24 in /etc
Closed about 1 year ago
icann/lgr-django #60
pip:django
Bump the dependencies group across 1 directory with 23 updates
Open about 1 year ago
djangonaut-space/wagtail-indymeet #491
pip:django
pip:pytest-mock
+21 more
Bump django from 4.2.22 to 4.2.24 in /backend
Open about 1 year ago
Zorik28/foodgram-project-react #48
pip:django
Bump django from 4.2.22 to 4.2.24
Merged about 1 year ago
Zorik28/hw05_final #11
pip:django
Bump django from 4.1.13 to 4.2.24
Merged about 1 year ago
John-Howard/ssri #8
pip:django
Bump django from 4.2.20 to 4.2.24 in /backend
Open about 1 year ago
Oslo-kommune-Utdanningsetaten/mestring #42
pip:django
Bump django from 3.2.25 to 4.2.24
Open about 1 year ago
ElenaVasilkova/infra_sprint1 #3
pip:django
Bump the python-packages group across 1 directory with 20 updates
Open about 1 year ago
nycnoise/nycnoise #562
pip:mypy
pip:boto3
+18 more
Bump django from 3.1.2 to 4.2.24 in /dostavka_info
Open about 1 year ago
yougottman/25_12_2019 #46
pip:django
Bump django from 5.1.9 to 5.1.12
Merged about 1 year ago
kevoreilly/CAPEv2 #2708
pip:django
Bump django from 4.2.17 to 4.2.24
Open about 1 year ago
kaviarasanmani/Tech_connect #12
pip:django
Bump django from 4.2.22 to 4.2.24
Open about 1 year ago
yassine-youcefi/Quiz #41
pip:django
Actions
Advisory Details
| Published: | June 05, 2025 over 1 year ago |
| Updated: | October 08, 2026 about 21 hours ago |
| CVSS Score: | 4.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N |
| EPSS: | 0.75% 54th percentile |
| Source: | Github |
| Classification: | GENERAL |
| UUID: | GSA_kwCzR0hTQS03eHI1LTloY3EtY2hmOc4ABIp6 |
PR Statistics
PR Status
Open
1953 (45.6%)
Merged
868 (20.3%)
Closed
1460 (34.1%)
Update Types
Major
1228 (13.1%)
Minor
3313 (35.4%)
Patch
4167 (44.5%)
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-48432
- https://docs.djangoproject.com/en/dev/releases/security
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2025/jun/04/security-releases
- http://www.openwall.com/lists/oss-security/2025/06/04/5
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-47.yaml
- https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases
- http://www.openwall.com/lists/oss-security/2025/06/10/2
- http://www.openwall.com/lists/oss-security/2025/06/10/3
- http://www.openwall.com/lists/oss-security/2025/06/10/4
- https://github.com/advisories/GHSA-7xr5-9hcq-chf9