---
title: "Django 5.2.7 release notes"
version: 5.2
locale: ga
source: https://docs.djangoproject.com/ga/5.2/releases/5.2.7/
canonical: https://djangodocs.dev/ga/5.2/releases/5.2.7/
---
# Django 5.2.7 release notes

*October 1, 2025*

Django 5.2.7 fixes one security issue with severity "high", one security issue
with severity "low", and one bug in 5.2.6. Also, the latest string translations
from Transifex are incorporated.

## CVE-2025-59681: Potential SQL injection in `QuerySet.annotate()`, `alias()`, `aggregate()`, and `extra()` on MySQL and MariaDB

[`QuerySet.annotate()`](/ga/5.2/ref/models/querysets/#django.db.models.query.QuerySet.annotate), [`alias()`](/ga/5.2/ref/models/querysets/#django.db.models.query.QuerySet.alias),
[`aggregate()`](/ga/5.2/ref/models/querysets/#django.db.models.query.QuerySet.aggregate), and [`extra()`](/ga/5.2/ref/models/querysets/#django.db.models.query.QuerySet.extra) methods were subject
to SQL injection in column aliases, using a suitably crafted dictionary, with
dictionary expansion, as the `**kwargs` passed to these methods (follow up to
[**CVE 2022-28346**](https://www.cve.org/CVERecord?id=CVE-2022-28346)).

## CVE-2025-59682: Potential partial directory-traversal via `archive.extract()`

The `django.utils.archive.extract()` function, used by
[`startapp --template`](/ga/5.2/ref/django-admin/#cmdoption-startapp-template) and [`startproject --template`](/ga/5.2/ref/django-admin/#cmdoption-startproject-template), allowed
partial directory-traversal via an archive with file paths sharing a common
prefix with the target directory (follow up to [**CVE 2021-3281**](https://www.cve.org/CVERecord?id=CVE-2021-3281)).

## Buigdheisiúcháin

- Fixed a regression in Django 5.2 that reduced the color contrast of
  the chosen label of `filter_horizontal` and `filter_vertical` widgets
  within a `TabularInline` ([#36601](https://code.djangoproject.com/ticket/36601)).