CVE-2009-2659
The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.
- EPSS
- 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- django_project:django
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9xg7-gg9m-rmq9 | PyPI | django | >=0.96.0 <0.96.4 | 0.96.4 |
| GHSA-9xg7-gg9m-rmq9 | PyPI | django | >=1.0 <1.0.3 | 1.0.3 |
| PYSEC-2009-3 | PyPI | django | <1.1 | 1.1 |