SQL injection in Django - CVE-2025-59681

Vulnerability identifier: #VU116426

CSH Severity: High

CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-59681

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data within the QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() methods. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Django
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
Ubuntu
SUSE Package Hub 15
openSUSE Leap
openEuler
Anolis OS
Storage Defender - Resiliency Service
Maximo Application Suite - Edge Data Collector
Ansible Automation Platform
python-django (Ubuntu package)
python3-Django
python-django-help
python-django
python-django (Debian package)
python311-Django
python3-django
python3-django-bash-completion
python3-django-doc

Install updates from vendor's website.

Django - addressed in versions 4.2.25, 5.1.13, 5.2.7
Storage Defender - Resiliency Service - update to 2.0.18
Maximo Application Suite - Edge Data Collector - addressed in versions 8.11.23, 9.0.15, 9.1.5
python-django (Ubuntu package) - addressed in versions 1.6.11-0ubuntu1.3+esm8, 1.8.7-1ubuntu5.15+esm9, 1:1.11.11-1ubuntu1.21+esm12, 2:2.2.12-1ubuntu0.29+esm4, 2:3.2.12-2ubuntu1.22, 3:4.2.11-1ubuntu1.11, 3:4.2.18-1ubuntu1.5
python3-Django - addressed in versions 2.2.27-19, 4.2.15-9
python-django-help - addressed in versions 2.2.27-19, 4.2.15-9
python-django - addressed in versions 2.2.27-19, 4.2.15-9
python-django (Debian package) - addressed in versions 3:3.2.25-0+deb12u1, 3:4.2.27-0+deb13u1
python311-Django - update to 4.2.11-150600.3.33.1
python3-django - update to 4.2.16-4
python3-django-bash-completion - update to 4.2.16-4
python3-django-doc - update to 4.2.16-4

• https://www.djangoproject.com/weblog/2025/oct/01/security-releases/

• Multiple vulnerabilities in Django
• SUSE update for python-Django
• Ubuntu update for python-django
• openEuler 24.03 LTS update for python-django
• openEuler 24.03 LTS SP2 update for python-django
• openEuler 20.03 LTS SP4 update for python-django
• openEuler 24.03 LTS SP1 update for python-django
• openEuler 22.03 LTS SP4 update for python-django
• openEuler 22.03 LTS SP3 update for python-django
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• Anolis OS update for python-django
• Multiple vulnerabilities in IBM Edge Data Collector
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.6
• Debian update for python-django
• Debian update for python-django