Django 4.2.25 release notesLien vers cette rubrique
October 1, 2025
Django 4.2.25 fixes one security issue with severity « high » and one security issue with severity « low » in 4.2.24.
CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDBLien vers cette rubrique
QuerySet.annotate(), alias(),
aggregate(), and extra() methods were subject
to SQL injection in column aliases, using a suitably crafted dictionary, with
dictionary expansion, as the **kwargs passed to these methods (follow up to
CVE 2022-28346).
CVE-2025-59682: Potential partial directory-traversal via archive.extract()Lien vers cette rubrique
The django.utils.archive.extract() function, used by
startapp --template and startproject --template, allowed
partial directory-traversal via an archive with file paths sharing a common
prefix with the target directory (follow up to CVE 2021-3281).