CVE-2025-48432 Django Improper Output Neutralization for Logs vulnerability

Medium 4.0 Published 5 Jun 2025 Updated 11 Jun 2025

Remote attackers can manipulate Django HTTP response logs via crafted URLs, potentially causing log injection or forgery in terminal or external log viewers.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-48432?

CVE-2025-48432 is a medium-severity vulnerability in Debian Debian Linux, published on 5 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

Weakness: CWE-117

Which versions are affected by CVE-2025-48432?

8 open source packages ship an affected version, including django and Django. It affects 2 products.

Package	Affected	Fixed in
`django` Bitnami	From `4.2.0`	`4.2.23, 5.1.11, 5.2.3`
`django` PyPI	All versions	`4.2.22`
`django` PyPI	From `5.0a1`	`5.1.10`
`django` PyPI	From `5.2`	`5.2.2, 5.1.10, 4.2.22`
`django` PyPI	From `5.2`	`5.2.2`
`Django` PyPI	All versions	`4.2.22`

2 more packages

`Django` PyPI	From `5.0a1`	`5.1.10`
`Django` PyPI	From `5.2`	`5.2.2`

Linux distribution packages (8)

`python-Django` SUSE:Linux Enterprise Module for Package Hub 15 SP6	All versions	`4.2.11-150600.3.24.1`
`python-Django` SUSE:Linux Enterprise Module for Package Hub 15 SP6	All versions	`4.2.11-150600.3.27.1`
`python-Django` SUSE:Linux Enterprise Module for Package Hub 15 SP7	All versions	`4.2.11-150600.3.24.1`
`python-Django` SUSE:Linux Enterprise Module for Package Hub 15 SP7	All versions	`4.2.11-150600.3.27.1`
`python-Django` openSUSE:Leap 15.6	All versions	`4.2.11-150600.3.24.1`
`python-Django` openSUSE:Leap 15.6	All versions	`4.2.11-150600.3.27.1`
`python-Django` openSUSE:Tumbleweed	All versions	`5.2.2-1.1`
`python-Django4` openSUSE:Tumbleweed	All versions	`4.2.22-1.1`

Products include Debian Debian Linux, Djangoproject Django.

How do I fix CVE-2025-48432?

Upgrade django to a fixed version for your release line: 4.2.23, 5.1.11, 5.2.3 or 4.2.22.

Is CVE-2025-48432 being exploited?

There is no known exploitation of CVE-2025-48432 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as BIT-django-2025-48432, CLSA-2025-1754352705, CLSA-2025-1762301491, CLSA-2026-1789475453, DEBIAN-CVE-2025-48432, ECHO-5ac0-dab3-bd4d and 16 more.