Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-48432

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

Published

2025-06-05T03:15:25.563

Last Modified

2025-10-15T17:47:56.647

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 4.0 (MEDIUM)

Weaknesses

Type: Secondary
CWE-117

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	djangoproject	django	< 4.2.23	Yes
Application	djangoproject	django	< 5.1.11	Yes
Application	djangoproject	django	< 5.2.3	Yes
Operating System	debian	debian_linux	11.0	Yes

References

https://docs.djangoproject.com/en/dev/releases/security/ Vendor Advisory ([email protected])
https://groups.google.com/g/django-announce Vendor Advisory ([email protected])
https://www.djangoproject.com/weblog/2025/jun/04/security-releases/ Vendor Advisory ([email protected])
https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases/ Release Notes ([email protected])
http://www.openwall.com/lists/oss-security/2025/06/04/5 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2025/06/10/2 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2025/06/10/3 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2025/06/10/4 Mailing List (af854a3a-2127-422b-91ae-364da2661108)