{"id":"CVE-2025-64459","kind":"vulnerability","aliases":["CVE-2025-64459"],"related":[],"title":"Django: crafted dictionaries let attackers inject SQL into queries","description":"WAF Release - 2026-02-02 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nFebruary 2, 2026\n\n## WAF Release - 2026-02-02\n\nThis week’s release introduces new detections for CVE-2025-64459 and CVE-2025-24893.\n\nKey Findings\n\n- CVE-2025-64459: Django versions prior to 5.1.14, 5.2.8, and 4.2.26 are vulnerable to SQL injection via crafted dictionaries passed to QuerySet methods and the `Q()` class.\n- CVE-2025-24893: XWiki allows unauthenticated remote code execution through crafted requests to the SolrSearch endpoint, affecting the entire installation.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...30698ff3 | N/A | XWiki - Remote Code Execution - CVE:CVE-2025-24893 2 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...da8ba7e6 | N/A | Django SQLI - CVE:CVE-2025-64459 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...8d667511 | N/A | NoSQL, MongoDB - SQLi - Comparison - 2 | Block | Block | Rule metadata description refined. Detection unchanged. |","summary":"Django versions before 4.2.26, 5.1.14 and 5.2.8 let crafted dictionaries passed to QuerySet methods and the Q() class inject SQL. An attacker who can send such input to a vulnerable view can read or change database contents.","severity":"critical","cvss":9.1,"epss":0.19257,"exploited":false,"exploited_at":null,"products":[{"name":"djangoproject django","fixed":["4.2.26"],"affected":">= 4.2, < 4.2.26","ecosystem":"vendor"},{"name":"djangoproject django","fixed":["5.1.14"],"affected":">= 5.1, < 5.1.14","ecosystem":"vendor"},{"name":"djangoproject django","fixed":["5.2.8"],"affected":">= 5.2, < 5.2.8","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloudflare","django","lab-disclosure","python","runtime","web-apps"],"not_affected_if":["patched-versions"],"how_to_check":"- Run `python -m django --version` and compare against `4.2.26`, `5.1.14` and `5.2.8`.\n- Search the codebase for QuerySet filter calls and `Q()` built from request data, such as `request.GET` or `request.POST` dictionaries.\n- Check whether Cloudflare's managed ruleset 'Django SQLI - CVE:CVE-2025-64459' is set to Block for your zone.","fix":"- Upgrade Django to `4.2.26`, `5.1.14` or `5.2.8`, matching your release line.\n- Until upgraded, set the Cloudflare WAF rule 'Django SQLI - CVE:CVE-2025-64459' to Block; it was Log before the 2026-02-02 release.","status":"open","published_at":"2025-11-05T15:15:41+00:00","first_seen_at":"2026-10-24T19:28:15+00:00","triaged_at":"2026-10-25T05:29:30+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T05:29:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Django to `4.2.26`, `5.1.14` or `5.2.8`, matching your release line.\n- Until upgraded, set the Cloudflare WAF rule 'Django SQLI - CVE:CVE-2025-64459' to Block; it was Log before the 2026-02-02 release.","reach":"internet","title":"Django: crafted dictionaries let attackers inject SQL into queries","impact":"high","summary":"Django versions before 4.2.26, 5.1.14 and 5.2.8 let crafted dictionaries passed to QuerySet methods and the Q() class inject SQL. An attacker who can send such input to a vulnerable view can read or change database contents.","category":"runtime","nicknames":[],"who_cares":["django","python","web-apps"],"confidence":0.7,"needs_auth":"unknown","worst_case":"SQL injection; database contents readable or changeable by attackers","analyst_note":"","how_to_check":"- Run `python -m django --version` and compare against `4.2.26`, `5.1.14` and `5.2.8`.\n- Search the codebase for QuerySet filter calls and `Q()` built from request data, such as `request.GET` or `request.POST` dictionaries.\n- Check whether Cloudflare's managed ruleset 'Django SQLI - CVE:CVE-2025-64459' is set to Block for your zone.","needs_analyst":false,"not_affected_if":["patched-versions"],"who_is_affected":"Applications running Django 4.2 before 4.2.26, 5.1 before 5.1.14 or 5.2 before 5.2.8 are affected. Exposure depends on whether untrusted input reaches QuerySet methods or Q() as a dictionary; sources do not detail which code paths are exploitable. Projects on patched releases can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.001213,"input_tokens":3949,"output_tokens":1636,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-02':72C,73C,88C,89C '-2025':11A,14A,99C,103C,108C,135C,177C,196C '-24893':104C,136C,178C '-64459':12A,15A,100C,109C,197C '2':83C,179C,214C '2026':71C,84C,87C '30698ff3':169C '4.2.26':35B,117C '5.1.14':36B,114C '5.2.8':38B,115C '8d667511':208C 'action':162C,164C 'affect':150C 'allow':138C 'app':31B 'attack':5A,53B 'block':181C,199C,215C,216C 'chang':66B 'changelog':74C,75C 'class':49B,133C 'cloudflar':22B,81C,166C,187C,205C 'code':141C,173C 'comment':165C 'comparison':213C 'content':68B 'craft':2A,40B,124C,144C 'cve':10A,13A,98C,102C,107C,134C,175C,176C,194C,195C 'da8ba7e6':190C 'databas':67B 'descript':160C,219C 'detect':96C,186C,204C,221C 'dictionari':3A,41B,125C 'disclosur':26B 'django':1A,17A,19A,21A,23B,32B,110C,192C 'djangoproject':16A,18A,20A 'endpoint':149C 'entir':152C 'execut':142C,174C 'februari':82C 'find':106C 'id':156C,159C 'improv':79C 'inject':6A,50B,122C 'input':58B 'instal':153C 'introduc':94C 'key':105C 'lab':25B 'lab-disclosur':24B 'legaci':157C 'let':4A,39B 'log':180C,198C 'manag':167C,188C,206C 'metadata':218C 'method':45B,129C 'mongodb':211C 'n/a':170C,191C,209C 'new':76C,95C,163C,185C,203C 'nosql':210C 'pass':42B,126C 'previous':161C 'prior':112C 'python':27B 'q':48B,132C 'queri':9A 'queryset':44B,128C 'read':64B 'refin':220C 'releas':70C,86C,93C 'remot':140C,172C 'request':145C 'rule':155C,158C,217C 'ruleset':154C,168C,189C,207C 'runtim':28B 'send':56B 'solrsearch':148C 'sql':7A,51B,121C 'sqli':193C,212C 'unauthent':139C 'unchang':222C 'updat':77C 'version':33B,111C 'via':123C 'view':62B 'vulner':61B,119C 'waf':69C,85C 'web':30B 'web-app':29B 'week':91C 'xwiki':137C,171C","nicknames":[],"mitigations":[],"who_affected":"Applications running Django 4.2 before 4.2.26, 5.1 before 5.1.14 or 5.2 before 5.2.8 are affected. Exposure depends on whether untrusted input reaches QuerySet methods or Q() as a dictionary; sources do not detail which code paths are exploitable. Projects on patched releases can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-11-05T15:15:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-02-02-waf-release/#CVE-2025-64459","url":"https://developers.cloudflare.com/changelog/post/2026-02-02-waf-release/","severity":null,"published_at":"2026-02-02T19:27:10+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:28:15+00:00","fetched_at":"2026-10-24T19:28:15+00:00","note":"Cloudflare: WAF Release - 2026-02-02 · Changelog"},{"source":"nvd","external_id":"CVE-2025-64459","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64459","severity":null,"published_at":"2025-11-05T15:15:41+00:00","modified_at":"2026-06-17T09:54:24+00:00","first_seen_at":"2026-10-24T20:15:27+00:00","fetched_at":"2026-10-24T20:15:27+00:00","note":null},{"source":"epss","external_id":"CVE-2025-64459","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-64459","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2942,"url":"https://developers.cloudflare.com/changelog/post/2026-02-02-waf-release/","title":"Cloudflare: WAF Release - 2026-02-02 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-02-02 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nFebruary 2, 2026\n\n## WAF Release - 2026-02-02\n\nThis week’s release introduces new detections for CVE-2025-64459 and CVE-2025-24893.\n\nKey Findings\n\n- CVE-2025-64459: Django versions prior to 5.1.14, 5.2.8, and 4.2.26 are vulnerable to SQL injection via crafted dictionaries passed to QuerySet methods and the `Q()` class.\n- CVE-2025-24893: XWiki allows unauthenticated remote code execution through crafted requests to the SolrSearch endpoint, affecting the entire installation.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...30698ff3 | N/A | XWiki - Remote Code Execution - CVE:CVE-2025-24893 2 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...da8ba7e6 | N/A | Django SQLI - CVE:CVE-2025-64459 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...8d667511 | N/A | NoSQL, MongoDB - SQLi - Comparison - 2 | Block | Block | Rule metadata description refined. Detection unchanged. |","published_at":"2026-02-02T19:27:10+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}