An issue was discovered in Django 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28 where using QuerySet.order_by with column aliases containing periods can lead to SQL injection when the same alias is also used with dictionary expansion in a FilteredRelation. The flaw allows an attacker to insert arbitrary SQL statements into a query, potentially enabling unauthorized reading, alteration, or deletion of database data. The weakness falls under SQL injection (CWE‑89).

The vulnerability affects Django 6.0, 5.2, and 4.2 series up to their respective non‑patched versions (<6.0.2, <5.2.11, <4.2.28). Earlier unsupported series such as 5.0.x, 4.1.x, and 3.2.x are also potentially affected. The impact applies to any application that constructs order_by clauses with user‑controlled column aliases that contain periods.

The CVSS score is 5.4, indicating medium severity. EPSS is less than 1%, implying a very low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Attackers would need the ability to influence the column alias names supplied to QuerySet.order_by and FilteredRelation; if such input is exposed to users, it is likely exploitable. No public exploit has been documented, but the low EPSS suggests limited activity.