An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-24dfd3b072 advisory.

    - Fixes CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL
    - Fixes CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer
    - Fixes CVE-2025-64459: Potential SQL injection via _connector keyword argument (5.2.8)
    - Fixes CVE-2025-59681: Potential SQL injection in QuerySet.annotate(),       alias(), aggregate(), and extra() on MySQL and MariaDB (5.2.7)
    - Fixes CVE-2025-59682: Potential partial directory-traversal via       archive.extract() (5.2.7)
    - Fixes CVE-2025-57833: Potential SQL injection in FilteredRelation       column aliases (5.2.6)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-b1379d950d advisory.

    - Fixes CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL
    - Fixes CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer
    - Fixes CVE-2025-64459: Potential SQL injection via _connector keyword       argument (4.2.26)
    - Fixes CVE-2025-59681: Potential SQL injection in QuerySet.annotate(),       alias(), aggregate(), and extra() on MySQL and MariaDB (4.2.25)
    - Fixes CVE-2025-59682: Potential partial directory-traversal via       archive.extract() (4.2.25)
    - Fixes CVE-2025-57833: Potential SQL injection in FilteredRelation column       aliases (4.2.24)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-45ee190318 advisory.

    - Fixes CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL
    - Fixes CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer
    - Fixes CVE-2025-64459: Potential SQL injection via _connector keyword argument (5.2.8)
    - Fixes CVE-2025-59681: Potential SQL injection in QuerySet.annotate(),       alias(), aggregate(), and extra() on MySQL and MariaDB (5.2.7)
    - Fixes CVE-2025-59682: Potential partial directory-traversal via       archive.extract() (5.2.7)
    - Fixes CVE-2025-57833: Potential SQL injection in FilteredRelation       column aliases (5.2.6)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4324 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4324-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                           Chris Lamb     October 07, 2025                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-django     Version        : 2:2.2.28-1~deb11u9     CVE IDs        : CVE-2025-59681 CVE-2025-59682     Debian Bug     : 1116979

    It was discovered that there were two vulnerabilities in Django, a     popular web development framework:

     * CVE-2025-59681: Fix a potential SQL injection in        QuerySet.annotate(), alias(), aggregate() and extra(). These        methods were subject to SQL injection in column aliases, using a        suitably crafted dictionary via dictionary expansion as the
       **kwargs passed to these methods on MySQL and MariaDB.

     * CVE-2025-59682: Fix a potential partial directory-traversal        vulnerability in archive.extract(). This function, used by        startapp --template and startproject --template allowed partial        directory-traversal via an archive with file paths sharing a        common prefix with the target directory.

    For Debian 11 bullseye, these problems have been fixed in version     2:2.2.28-1~deb11u9.

    We recommend that you upgrade your python-django packages.

    For the detailed security status of python-django please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-django

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7.
    QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL     injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the
    **kwargs passed to these methods (on MySQL and MariaDB). (CVE-2025-59681)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03446-1 advisory.

    - CVE-2025-59681: SQL injection via the `QuerySet` annotate()`, `alias()`, `aggregate()`, or `extra()`     methods when       processing a specially crafted dictionary with dictionary expansion (bsc#1250485).
    - CVE-2025-59682: directory traversal via the `django.utils.archive.extract()` function when processing an     archive with       file paths that share a common prefix with the target directory (bsc#1250487).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 90fc859e-9fe4-11f0-9fa2-080027836e8b advisory.

    Django reports:
    CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL     and MariaDB.
    CVE-2025-59682: Potential partial directory-traversal via archive.extract().

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7794-1 advisory.

    It was discovered that Django incorrectly handled special characters in the QuerySet function calls. A     remote attacker could possibly use this issue to perform SQL injection attacks. (CVE-2025-59681)

    It was discovered that Django incorrectly handled files with the same path prefix when starting with a     template. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-59682)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
279045	Fedora 43 : python-django5 (2025-24dfd3b072)	Nessus	Fedora Local Security Checks	medium
279042	Fedora 42 : python-django4.2 (2025-b1379d950d)	Nessus	Fedora Local Security Checks	medium
279041	Fedora 42 : python-django5 (2025-45ee190318)	Nessus	Fedora Local Security Checks	medium
269725	Debian dla-4324 : python-django-doc - security update	Nessus	Debian Local Security Checks	critical
269574	Linux Distros Unpatched Vulnerability : CVE-2025-59681	Nessus	Misc.	critical
266439	SUSE SLES15 / openSUSE 15 Security Update : python-Django (SUSE-SU-2025:03446-1)	Nessus	SuSE Local Security Checks	high
266430	FreeBSD : Django -- multiple vulnerabilities (90fc859e-9fe4-11f0-9fa2-080027836e8b)	Nessus	FreeBSD Local Security Checks	high
266399	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 : Django vulnerabilities (USN-7794-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2025-59681

critical

Tenable Plugins

medium

medium

medium

critical

critical

high

high

high