---
title: "Django 4.2.25 release notes"
version: 5.2
locale: it
source: https://docs.djangoproject.com/it/5.2/releases/4.2.25/
canonical: https://djangodocs.dev/it/5.2/releases/4.2.25/
---
# Django 4.2.25 release notes

*October 1, 2025*

Django 4.2.25 fixes one security issue with severity «high» and one security
issue with severity «low» in 4.2.24.

## CVE-2025-59681: Potential SQL injection in `QuerySet.annotate()`, `alias()`, `aggregate()`, and `extra()` on MySQL and MariaDB

[`QuerySet.annotate()`](/it/5.2/ref/models/querysets/#django.db.models.query.QuerySet.annotate), [`alias()`](/it/5.2/ref/models/querysets/#django.db.models.query.QuerySet.alias),
[`aggregate()`](/it/5.2/ref/models/querysets/#django.db.models.query.QuerySet.aggregate), and [`extra()`](/it/5.2/ref/models/querysets/#django.db.models.query.QuerySet.extra) methods were subject
to SQL injection in column aliases, using a suitably crafted dictionary, with
dictionary expansion, as the `**kwargs` passed to these methods (follow up to
[**CVE 2022-28346**](https://www.cve.org/CVERecord?id=CVE-2022-28346)).

## CVE-2025-59682: Potential partial directory-traversal via `archive.extract()`

The `django.utils.archive.extract()` function, used by
[`startapp --template`](/it/5.2/ref/django-admin/#cmdoption-startapp-template) and [`startproject --template`](/it/5.2/ref/django-admin/#cmdoption-startproject-template), allowed
partial directory-traversal via an archive with file paths sharing a common
prefix with the target directory (follow up to [**CVE 2021-3281**](https://www.cve.org/CVERecord?id=CVE-2021-3281)).