CVE-2025-48432 log

Source
Severity Low
Remote Yes
Type Content spoofing
Description 
Internal HTTP response logging used request.path directly, allowing control characters (e.g. newlines or ANSI escape sequences) to be written unescaped into logs. This could enable log injection or forgery, letting attackers manipulate log appearance or structure, especially in logs processed by external systems or viewed in terminals.
Group Package Affected Fixed Severity Status Ticket
AVG-2894 python-django 5.1.9-1 5.1.11-1 Low Fixed
Date Advisory Group Package Severity Type
12 Jun 2025 ASA-202506-6 AVG-2894 python-django Low content spoofing
References 
https://www.djangoproject.com/weblog/2025/jun/04/security-releases/
https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases/
https://docs.djangoproject.com/en/dev/releases/5.1.10/#cve-2025-48432-potential-log-injection-via-unescaped-request-path
https://docs.djangoproject.com/en/dev/releases/5.1.11/