Django up to 4.2.26/5.1.14/5.2.8 FilteredRelation QuerySet.annotate/QuerySet.alias sql injection

Summaryinfo

A vulnerability classified as critical was found in Django up to 4.2.26/5.1.14/5.2.8. Affected by this issue is the function QuerySet.annotate/QuerySet.alias of the component FilteredRelation. Such manipulation leads to sql injection. This vulnerability is uniquely identified as CVE-2025-13372. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Django up to 4.2.26/5.1.14/5.2.8. Affected by this issue is the function QuerySet.annotate/QuerySet.alias of the component FilteredRelation. The manipulation with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

The advisory is available at docs.djangoproject.com. This vulnerability is handled as CVE-2025-13372 since 11/18/2025. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 01/10/2026). This vulnerability is assigned to T1505 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 277097 (Linux Distros Unpatched Vulnerability : CVE-2025-13372), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.2.27, 5.1.15 or 5.2.9 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (277097), EUVD (EUVD-2025-200249) and CERT Bund (WID-SEC-2025-2717). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Debian Linux
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• SUSE openSUSE
• Open Source Django

Productinfo

Type

• Content Management System

Name

• Django

Version

• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5
• 4.2.6
• 4.2.7
• 4.2.8
• 4.2.9
• 4.2.10
• 4.2.11
• 4.2.12
• 4.2.13
• 4.2.14
• 4.2.15
• 4.2.16
• 4.2.17
• 4.2.18
• 4.2.19
• 4.2.20
• 4.2.21
• 4.2.22
• 4.2.23
• 4.2.24
• 4.2.25
• 4.2.26
• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5
• 5.1.6
• 5.1.7
• 5.1.8
• 5.1.9
• 5.1.10
• 5.1.11
• 5.1.12
• 5.1.13
• 5.1.14
• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 5.2.4
• 5.2.5
• 5.2.6
• 5.2.7
• 5.2.8

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion