Django 4.2.25 release notes¶
October 1, 2025
Django 4.2.25 fixes one security issue with severity “high” and one security issue with severity “low” in 4.2.24.
CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB¶
QuerySet.annotate(), alias(),
aggregate(), and extra() methods were subject
to SQL injection in column aliases, using a suitably crafted dictionary, with
dictionary expansion, as the **kwargs passed to these methods (follow up to
CVE 2022-28346).
CVE-2025-59682: Potential partial directory-traversal via archive.extract()¶
The django.utils.archive.extract() function, used by
startapp --template and startproject --template, allowed
partial directory-traversal via an archive with file paths sharing a common
prefix with the target directory (follow up to CVE 2021-3281).
