Debian: Moderate SQL Injection and Directory Traversal in python-django

debian lts

October 8, 2025

It was discovered that there were two vulnerabilities in Django, a popular web development framework: * CVE-2025-59681: Fix a potential SQL injection in

Topics Covered

security advisory moderate SQL Injection debian directory traversal python-django

Summary

* CVE-2025-59681: Fix a potential SQL injection in
QuerySet.annotate(), alias(), aggregate() and extra(). These
methods were subject to SQL injection in column aliases, using a
suitably crafted dictionary via dictionary expansion as the
**kwargs passed to these methods on MySQL and MariaDB.

* CVE-2025-59682: Fix a potential partial directory-traversal
vulnerability in archive.extract(). This function, used by
startapp --template and startproject --template allowed partial
directory-traversal via an archive with file paths sharing a
common prefix with the target directory.

For Debian 11 bullseye, these problems have been fixed in version
2:2.2.28-1~deb11u9.

We recommend that you upgrade your python-django packages.

For the detailed security status of python-django please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/python-django

Further information about Debian LTS security advisories, how to apply