Skip to main content

Improper Output Neutralization for Logs in Django

CVE-2025-48432

  • Django
Medium
5.3/10

Summary

An issue was discovered in Django. Internal HTTP response logging does not escape "request.path", which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to Log Injection or forgery when logs are viewed in terminals or processed by external systems. This issue affects versions 2.1a1 through 4.2.21, 5.0a1 through 5.1.9 and 5.2a1 through 5.2.1.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-117 - Improper Output Neutralization for Logs

The software does not neutralize or incorrectly neutralizes output that is written to logs.

References

Advisory Timeline

  • Published