HackerOne Disclosed Reports - 2025-09-15

Critical
resolved

SQL Injection when using FilteredRelation

Bug reported by Eyal Gabay was disclosed at September 15, 2025, 2:01 pm   |   SQL Injection

A SQL injection vulnerability was discovered in the Django framework when using the FilteredRelation feature. The vulnerability was located in the tests/filtered_relation/tests.py file. The vulnerability allowed an attacker to inject malicious SQL code through the user_data parameter used in the FilteredRelation and select_related functions.