GHSA-q95w-c7qg-hrff

Django vulnerable to partial directory traversal via archives

Source: GitHub Advisory Database (reviewed) Low CVE-2025-59682

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	django	>= 4.2, < 4.2.25	4.2.25
PyPI	django	>= 5.1, < 5.1.13	5.1.13
PyPI	django	>= 5.2, < 5.2.7	5.2.7

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-59682 advisory
https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e web
https://github.com/django/django/commit/924a0c092e65fa2d0953fd1855d2dc8786d94de2 web
https://docs.djangoproject.com/en/dev/releases/security web
https://github.com/django/django package
https://groups.google.com/g/django-announce web
https://www.djangoproject.com/weblog/2025/oct/01/security-releases web
http://www.openwall.com/lists/oss-security/2025/10/01/3 web