Security update for python-Django
This update for python-Django fixes the following issues: - CVE-2025-59681: SQL injection via the `QuerySet` annotate()`, `alias()`, `aggregate()`, or `extra()` methods when processing a specially crafted dictionary with dictionary expansion (bsc#1250485). - CVE-2025-59682: directory traversal via the `django.utils.archive.extract()` function when processing an archive with file paths that share a common prefix with the target directory (bsc#1250487).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for python-Django fixes the following issues: - CVE-2025-59681: SQL injection via the `QuerySet` annotate()`, `alias()`, `aggregate()`, or `extra()` methods when processing a specially crafted dictionary with dictionary expansion (bsc#1250485). - CVE-2025-59682: directory traversal via the `django.utils.archive.extract()` function when processing an archive with file paths that share a common prefix with the target directory (bsc#1250487).
05 / REFERENCES