An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.

vendor_unpatched cve-2025-59682: Unpatched CVEs for Debian Linux (cve-2025-59682)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03446-1 advisory.

    - CVE-2025-59681: SQL injection via the `QuerySet` annotate()`, `alias()`, `aggregate()`, or `extra()`     methods when       processing a specially crafted dictionary with dictionary expansion (bsc#1250485).
    - CVE-2025-59682: directory traversal via the `django.utils.archive.extract()` function when processing an     archive with       file paths that share a common prefix with the target directory (bsc#1250487).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 90fc859e-9fe4-11f0-9fa2-080027836e8b advisory.

    Django reports:
    CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL     and MariaDB.
    CVE-2025-59682: Potential partial directory-traversal via archive.extract().

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7794-1 advisory.

    It was discovered that Django incorrectly handled special characters in the QuerySet function calls. A     remote attacker could possibly use this issue to perform SQL injection attacks. (CVE-2025-59681)

    It was discovered that Django incorrectly handled files with the same path prefix when starting with a     template. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-59682)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
266439	SUSE SLES15 / openSUSE 15 Security Update : python-Django (SUSE-SU-2025:03446-1)	Nessus	SuSE Local Security Checks	high
266430	FreeBSD : Django -- multiple vulnerabilities (90fc859e-9fe4-11f0-9fa2-080027836e8b)	Nessus	FreeBSD Local Security Checks	high
266399	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 : Django vulnerabilities (USN-7794-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2025-59682

low

Tenable Plugins

Coming Soon

high

high

high