GitHub Advisoryadvisory · PyPI

GHSA-jrh2-hc4r-7jwx Directory-traversal in Django

MEDIUM Published 2022-01-12 Modified 2024-09-20 Official page ↗
Aliases
CVE-2021-45452
Ecosystem
PyPI
Packages
Django
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Reviewed
2022-01-12

Affected packages

• PyPI Django: >= 2.2, < 2.2.26 → fixed in 2.2.26 • PyPI Django: >= 3.2, < 3.2.11 → fixed in 3.2.11 • PyPI Django: >= 4.0, < 4.0.1 → fixed in 4.0.1

Description

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.

Related

Alias · CVE (1)

  • CVE-2021-45452 Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References