Django 4.2.25 release notesLink para este cabeçalho
October 1, 2025
Django 4.2.25 fixes one security issue with severity “high” and one security issue with severity “low” in 4.2.24.
CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDBLink para este cabeçalho
QuerySet.annotate(), alias(),
aggregate(), and extra() methods were subject
to SQL injection in column aliases, using a suitably crafted dictionary, with
dictionary expansion, as the **kwargs passed to these methods (follow up to
CVE 2022-28346).
CVE-2025-59682: Potential partial directory-traversal via archive.extract()Link para este cabeçalho
The django.utils.archive.extract() function, used by
startapp --template and startproject --template, allowed
partial directory-traversal via an archive with file paths sharing a common
prefix with the target directory (follow up to CVE 2021-3281).