Critical Log Injection Vulnerability in Python-Django Package
Summary
UBUNTU-CVE-2025-48432: An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Affects python-django versions 1.5.4-1ubuntu1 – 1.6.11-0ubuntu1.3+esm7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features including an ORM, URL routing, and an admin interface. However, certain versions of Python-Django are vulnerable to a log injection issue that can compromise the integrity of log files.
Vulnerability Detail
An issue was discovered in Django versions 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. The vulnerability arises from improper handling of HTTP response logging, specifically the failure to escape the request.path. This allows remote attackers to manipulate log output through crafted URLs, potentially leading to log injection or forgery when logs are viewed in terminals or processed by external systems. The CVSS score for this vulnerability is 4.0, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can limit access to the logging functionality or sanitize inputs to the logging functions to prevent crafted URLs from being logged. This can be done by implementing input validation and escaping mechanisms in your application code.
Conclusion
The log injection vulnerability in Python-Django poses a significant risk to applications using affected versions. It is crucial to update to the latest patched versions to mitigate this risk. Users should also consider implementing workarounds until they can apply the necessary updates.
See every vulnerability recorded for python-django →
FAQ
The vulnerability allows attackers to inject malicious content into log files, which can lead to log forgery and manipulation.
Affected versions include Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing input validation and sanitization as a temporary workaround.
The CVSS score for this vulnerability is 4.0, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
