~ / search / GHSA-9jmf-237g-qf46

GHSA-9jmf-237g-qf46

Django Path Traversal vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-39330

Packages

EcosystemPackageAffectedFixed in
PyPI Django >= 5.0, < 5.0.7 5.0.7
PyPI Django >= 4.2, < 4.2.14 4.2.14

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the `django.core.files.storage.Storage` base class, when they override `generate_filename()` without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a `save()` call. (Built-in Storage sub-classes are unaffected.)

References

External links from the advisory. They lead to third-party sites.