CVE-2025-48432

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

A vulnerability, which was classified as problematic, was found in Django up to 4.2.21/5.1.9/5.2.1 (Content Management System).CWE is classifying the issue as CWE-117. The product does not neutralize or incorrectly neutralizes output that is written to logs.This is going to have an impact on integrity.Upgrading to version 4.2.22, 5.1.10 or 5.2.2 eliminates this vulnerability.(CVE-2025-48432)

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

A vulnerability, which was classified as problematic, was found in Django up to 4.2.21/5.1.9/5.2.1 (Content Management System).CWE is classifying the issue as CWE-117. The product does not neutralize or incorrectly neutralizes output that is written to logs.This is going to have an impact on integrity.Upgrading to version 4.2.22, 5.1.10 or 5.2.2 eliminates this vulnerability.(CVE-2025-48432)

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

A vulnerability, which was classified as problematic, was found in Django up to 4.2.21/5.1.9/5.2.1 (Content Management System).CWE is classifying the issue as CWE-117. The product does not neutralize or incorrectly neutralizes output that is written to logs.This is going to have an impact on integrity.Upgrading to version 4.2.22, 5.1.10 or 5.2.2 eliminates this vulnerability.(CVE-2025-48432)

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

A vulnerability, which was classified as problematic, was found in Django up to 4.2.21/5.1.9/5.2.1 (Content Management System).CWE is classifying the issue as CWE-117. The product does not neutralize or incorrectly neutralizes output that is written to logs.This is going to have an impact on integrity.Upgrading to version 4.2.22, 5.1.10 or 5.2.2 eliminates this vulnerability.(CVE-2025-48432)

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

A vulnerability, which was classified as problematic, was found in Django up to 4.2.21/5.1.9/5.2.1 (Content Management System).CWE is classifying the issue as CWE-117. The product does not neutralize or incorrectly neutralizes output that is written to logs.This is going to have an impact on integrity.Upgrading to version 4.2.22, 5.1.10 or 5.2.2 eliminates this vulnerability.(CVE-2025-48432)

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

TuxCare rebuilt django to address 1 CVE. Fixed in 5.1.9.post1+tuxcare.

TuxCare rebuilt django to address 1 CVE. Fixed in 4.2.post1+tuxcare.

TuxCare rebuilt django to address 2 CVEs. Fixed in 4.0.post15+tuxcare.

TuxCare rebuilt django to address 4 CVEs. Fixed in 5.1.4.post4+tuxcare.

TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.post6+tuxcare.

TuxCare rebuilt django to address 2 CVEs. Fixed in 5.0.2.post7+tuxcare.

TuxCare rebuilt django to address 5 CVEs. Fixed in 5.0.1.post9+tuxcare.

TuxCare rebuilt django to address 1 CVE. Fixed in 3.2.25.post5+tuxcare.

TuxCare rebuilt django to address 4 CVEs. Fixed in 5.0.post13+tuxcare.

Potential log injection via unescaped request path. (CVE-2025-48432)

These are all security issues fixed in the python311-Django-5.2.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-Django4-4.2.22-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

Root has patched CVE-2025-48432 in the django package for Root:PyPI. Multiple fixed versions available.

This update for python-Django fixes the following issues:

• CVE-2025-48432: log injection or forgery due to unescaped control characters being added into logs (bsc#1244095).

This update for python-Django fixes the following issues:

• CVE-2025-48432: Add an additional hardening for CVE-2025-48432 (bsc#1244095)

It was discovered that Django incorrectly handled certain unescaped request paths. An attacker could possibly use this issue to perform a log injection.