Vulnerability	Vulnerable Version
M SQL Injection Affected versions of this package are vulnerable to SQL Injection in the `QuerySet.annotate()`, `QuerySet.alias()`, `QuerySet.aggregate()`, and `QuerySet.extra()` methods when a specially crafted dictionary is passed using dictionary expansion as `**kwargs`, leading to unsafe column aliases on MySQL and MariaDB. An attacker can access sensitive information or manipulate query results by injecting malicious SQL through these parameters. How to fix SQL Injection? Upgrade `django` to version 4.2.25, 5.1.13, 5.2.7 or higher.	[4.2,4.2.25)[5.1,5.1.13)[5.2,5.2.7)
L Relative Path Traversal Affected versions of this package are vulnerable to Relative Path Traversal via the `django.utils.archive.extract()` function used by `startapp --template` and `startproject --template`. An attacker can modify files outside the intended extraction directory by crafting an archive with file paths that share a common prefix with the target directory. How to fix Relative Path Traversal? Upgrade `django` to version 4.2.25, 5.1.13, 5.2.7 or higher.	[4.2,4.2.25)[5.1,5.1.13)[5.2,5.2.7)

SQL Injection

Affected versions of this package are vulnerable to SQL Injection in the QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() methods when a specially crafted dictionary is passed using dictionary expansion as **kwargs, leading to unsafe column aliases on MySQL and MariaDB. An attacker can access sensitive information or manipulate query results by injecting malicious SQL through these parameters.

How to fix SQL Injection?

Upgrade django to version 4.2.25, 5.1.13, 5.2.7 or higher.

[4.2,4.2.25)[5.1,5.1.13)[5.2,5.2.7)

Relative Path Traversal

Affected versions of this package are vulnerable to Relative Path Traversal via the django.utils.archive.extract() function used by startapp --template and startproject --template. An attacker can modify files outside the intended extraction directory by crafting an archive with file paths that share a common prefix with the target directory.

How to fix Relative Path Traversal?

Upgrade django to version 4.2.25, 5.1.13, 5.2.7 or higher.

[4.2,4.2.25)[5.1,5.1.13)[5.2,5.2.7)

Go back to all versions of this package