Critical SQL Injection and Information Disclosure Vulnerabilities in python-django
Summary
USN-7794-1: python-django vulnerabilities. Affects python-django versions < 1.6.11-0ubuntu1.3+esm8. Fixed in 1.6.11-0ubuntu1.3+esm8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features, including an ORM, templating engine, and URL routing. However, recent vulnerabilities have been discovered that could compromise the security of applications built with this framework.
Vulnerability Detail
Two significant vulnerabilities have been identified in python-django. The first vulnerability (CVE-2025-59681) involves improper handling of special characters in QuerySet function calls, which could allow remote attackers to execute SQL injection attacks. The second vulnerability (CVE-2025-59682) pertains to the mishandling of files with the same path prefix when starting with a template, potentially enabling attackers to access sensitive information. Both vulnerabilities stem from flaws in the framework's handling of user input and file management.
How To Fix
Minimum fixed version
1.6.11-0ubuntu1.3+esm8
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is advisable to sanitize user inputs and validate file paths rigorously to mitigate the risk of SQL injection and information disclosure until the package can be updated.
Conclusion
In summary, critical vulnerabilities have been identified in python-django that could lead to SQL injection and information disclosure. It is crucial for users to update to the patched versions of the package to safeguard their applications. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for python-django →
FAQ
The main vulnerabilities include SQL injection due to improper handling of special characters in QuerySet function calls and information disclosure from mishandling files with the same path prefix.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Affected versions include python-django 1.6.11, 1.8.7, 1.11.11, 2.2.12, 3.2.12, 4.2.11, and 4.2.18 across various Ubuntu distributions.
Yes, patches are available in the form of updated package versions for each affected Ubuntu distribution.
If immediate updates are not possible, ensure to implement input sanitization and file path validation as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
