GHSA-jrh2-hc4r-7jwx

Directory-traversal in Django

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-45452

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Django	>= 2.2, < 2.2.26	2.2.26
PyPI	Django	>= 3.2, < 3.2.11	3.2.11
PyPI	Django	>= 4.0, < 4.0.1	4.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-45452 advisory
https://github.com/django/django/commit/4cb35b384ceef52123fc66411a73c36a706825e1 web
https://github.com/django/django/commit/8d2f7cff76200cbd2337b2cf1707e383eb1fb54b web
https://github.com/django/django/commit/e1592e0f26302e79856cc7f2218ae848ae19b0f6 web
https://docs.djangoproject.com/en/4.0/releases/security web
https://github.com/advisories/GHSA-jrh2-hc4r-7jwx advisory
https://github.com/django/django package
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-3.yaml web
https://groups.google.com/forum/#!forum/django-announce web
https://lists.fedoraproject.org/archives/list/[email protected]/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV web
https://security.netapp.com/advisory/ntap-20220121-0005 web
https://www.djangoproject.com/weblog/2022/jan/04/security-releases web