CVE-2025-48432: An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path…

PriorityP429medium5.3CVSS 3.1

AVNACLPRNUINSUCNILAN

EPSS

0.63%

46.1th percentile

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	python-django	< python-django 3:3.2.25-0+deb12u1 (bookworm)	python-django 3:3.2.25-0+deb12u1 (bookworm)
djangoproject	django	>= 0 < 4.2.22	4.2.22
djangoproject	django	>= 4.2 < 4.2.23	4.2.23
djangoproject	django	>= 4.2 < 4.2.22	4.2.22
djangoproject	django	>= 5.0a1 < 5.1.10	5.1.10
djangoproject	django	>= 5.1 < 5.1.11	5.1.11
djangoproject	django	>= 5.1 < 5.1.10	5.1.10
djangoproject	django	>= 5.2 < 5.2.3	5.2.3
djangoproject	django	>= 5.2 < 5.2.2	5.2.2

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

osv5.3MEDIUM

vendor_debian4.0MEDIUM

vendor_redhat4.0MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.