CVE-2025-59681

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods on MySQL and MariaDB.(CVE-2025-59681)

A critical vulnerability was found in Django up to 4.2.24/5.1.12/5.2.6. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. Upgrading to version 4.2.25, 5.1.13 or 5.2.7 eliminates this vulnerability.(CVE-2025-59682)

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods on MySQL and MariaDB.(CVE-2025-59681)

A critical vulnerability was found in Django up to 4.2.24/5.1.12/5.2.6. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. Upgrading to version 4.2.25, 5.1.13 or 5.2.7 eliminates this vulnerability.(CVE-2025-59682)

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods on MySQL and MariaDB.(CVE-2025-59681)

A critical vulnerability was found in Django up to 4.2.24/5.1.12/5.2.6. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. Upgrading to version 4.2.25, 5.1.13 or 5.2.7 eliminates this vulnerability.(CVE-2025-59682)

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods on MySQL and MariaDB.(CVE-2025-59681)

A critical vulnerability was found in Django up to 4.2.24/5.1.12/5.2.6. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. Upgrading to version 4.2.25, 5.1.13 or 5.2.7 eliminates this vulnerability.(CVE-2025-59682)

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods on MySQL and MariaDB.(CVE-2025-59681)

A critical vulnerability was found in Django up to 4.2.24/5.1.12/5.2.6. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. Upgrading to version 4.2.25, 5.1.13 or 5.2.7 eliminates this vulnerability.(CVE-2025-59682)

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods on MySQL and MariaDB.(CVE-2025-59681)

A critical vulnerability was found in Django up to 4.2.24/5.1.12/5.2.6. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. Upgrading to version 4.2.25, 5.1.13 or 5.2.7 eliminates this vulnerability.(CVE-2025-59682)

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).

TuxCare rebuilt django to address 5 CVEs. Fixed in 4.2.post3+tuxcare.

TuxCare rebuilt django to address 10 CVEs. Fixed in 5.1.10.post2+tuxcare.

TuxCare rebuilt django to address 11 CVEs. Fixed in 5.1.9.post3+tuxcare.

TuxCare rebuilt django to address 11 CVEs. Fixed in 5.1.4.post3+tuxcare.

TuxCare rebuilt django to address 11 CVEs. Fixed in 5.1.post5+tuxcare.

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB). (CVE-2025-59681) An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory. (CVE-2025-59682)

These are all security issues fixed in the python311-Django4-4.2.25-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-Django-5.2.7-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python-Django fixes the following issues:

• CVE-2025-59681: Fixed a potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB (boo#1250485)
• CVE-2025-59682: Fixed a potential partial directory-traversal via archive.extract() (boo#1250487)

These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python-Django fixes the following issues:

• CVE-2025-59681: SQL injection via the QuerySet annotate(), alias(), aggregate(), or extra()` methods when processing a specially crafted dictionary with dictionary expansion (bsc#1250485).
• CVE-2025-59682: directory traversal via the django.utils.archive.extract() function when processing an archive with file paths that share a common prefix with the target directory (bsc#1250487).

It was discovered that Django incorrectly handled special characters in the QuerySet function calls. A remote attacker could possibly use this issue to perform SQL injection attacks. (CVE-2025-59681)

It was discovered that Django incorrectly handled files with the same path prefix when starting with a template. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-59682)