PT-2025-48697 · Django+4 · Django+4
Jacob Walls
+2
·
Published
2025-12-02
·
Updated
2026-01-29
·
CVE-2025-13372
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Django versions 4.2 through 4.2.26
Django versions 5.1 through 5.1.14
Django versions 5.2 through 5.2.8
Django versions 5.0.x and earlier
Django versions 4.1.x and earlier
Django versions 3.2.x and earlier
Description
An issue exists in Django where
FilteredRelation is susceptible to SQL injection in column aliases. This occurs when a crafted dictionary is used with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Approximately 1.7 million potentially affected devices have been identified. The issue involves the use of the QuerySet.annotate() and QuerySet.alias() functions, which can be exploited through manipulated column aliases. The vulnerable component is FilteredRelation.Recommendations
Update to Django version 5.2.9 or later.
Update to Django version 5.1.15 or later.
Update to Django version 4.2.27 or later.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Django
Linuxmint
Red Os
Ubuntu