Django (FilteredRelation): Schwachstelle ermöglicht SQL injection
WID-SEC-2025-1961 · first 04.09.2025 · updated 20.02.2026 · CVSS 7,1
What it is about
Django ist ein in Python geschriebenes serverseitiges Web-Framework, das einem Model-View-Presenter-Schema folgt. Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Django ausnutzen, um eine SQL-Injection durchzuführen.
Under what conditions?
Over the network, but only with valid access (login required), for example with stolen credentials or as an insider.
What can happen in the worst case
An attacker could use the vulnerability to
- eine SQL-Injection durchzuführen
Am I affected?
Affected according to the BSI:
- Debian Linux
- Red Hat Enterprise Linux
- Fedora Linux
- Ubuntu Linux
- SUSE Linux
- SUSE openSUSE
- Red Hat Ansible Automation Platform 2.5
- Open Source Django <5.2.6
- Open Source Django <5.1.12
- Open Source Django <4.2.24
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Open Source Django 5.2.6
- Open Source Django 5.1.12
- Open Source Django 4.2.24
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- Django security releases 5.2.6, 5.1.12, and 4.2.24 vom 2025-09-03 www.djangoproject.com
- Ubuntu Security Notice USN-7736-1 vom 2025-09-04 ubuntu.com
- SUSE Security Update SUSE-SU-2025:03074-1 vom 2025-09-04 lists.suse.com
- openSUSE Security Update OPENSUSE-SU-2025:0335-1 vom 2025-09-05 lists.opensuse.org
- Debian Security Advisory DLA-4301 vom 2025-09-16 lists.debian.org
- Red Hat Security Advisory RHSA-2025:16403 vom 2025-09-22 access.redhat.com
- Red Hat Security Advisory RHSA-2025:16404 vom 2025-09-23 access.redhat.com
- Red Hat Security Advisory RHSA-2025:16514 vom 2025-09-23 access.redhat.com
- Red Hat Security Advisory RHSA-2025:16487 vom 2025-09-23 access.redhat.com
- Red Hat Security Advisory RHSA-2025:17500 vom 2025-10-07 access.redhat.com
- Red Hat Security Advisory RHSA-2025:17499 vom 2025-10-07 access.redhat.com
- Red Hat Security Advisory RHSA-2025:17498 vom 2025-10-07 access.redhat.com
- Fedora Security Advisory FEDORA-EPEL-2025-F43C018F46 vom 2025-12-09 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2025-B1379D950D vom 2025-12-09 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2025-24DFD3B072 vom 2025-12-09 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2025-45EE190318 vom 2025-12-09 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2025-C08E0795C0 vom 2025-12-09 bodhi.fedoraproject.org
- openSUSE Security Update OPENSUSE-SU-2026:10005-1 vom 2026-01-04 lists.opensuse.org
- Debian Security Advisory DSA-6117 vom 2026-01-31 lists.debian.org
- Debian Security Advisory DSA-6136 vom 2026-02-15 lists.debian.org
- Debian Security Advisory DLA-4484 vom 2026-02-19 lists.debian.org
CVE: CVE-2025-57833
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.