Django up to 4.2.21/5.1.9/5.2.1 neutralization for logs

Summaryinfo

A vulnerability was found in Django up to 4.2.21/5.1.9/5.2.1 and classified as problematic. The affected element is an unknown function. The manipulation results in neutralization for logs. This vulnerability is identified as CVE-2025-48432. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Django up to 4.2.21/5.1.9/5.2.1. Affected is an unknown code. The manipulation with an unknown input leads to a neutralization for logs vulnerability. CWE is classifying the issue as CWE-117. The product does not neutralize or incorrectly neutralizes output that is written to logs. This is going to have an impact on integrity. CVE summarizes:

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

The advisory is shared for download at seclists.org. This vulnerability is traded as CVE-2025-48432 since 05/21/2025. The exploitability is told to be easy. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/16/2025).

The vulnerability scanner Nessus provides a plugin with the ID 238025 (Debian dla-4210 : python-django-doc - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.2.22, 5.1.10 or 5.2.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (238025) and EUVD (EUVD-2025-16951). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• Django

Version

• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5
• 4.2.6
• 4.2.7
• 4.2.8
• 4.2.9
• 4.2.10
• 4.2.11
• 4.2.12
• 4.2.13
• 4.2.14
• 4.2.15
• 4.2.16
• 4.2.17
• 4.2.18
• 4.2.19
• 4.2.20
• 4.2.21
• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5
• 5.1.6
• 5.1.7
• 5.1.8
• 5.1.9
• 5.2.0
• 5.2.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion