CVE-2013-4315
Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a .. (dot dot) in a ssi template tag.
- EPSS
- 3.2% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- djangoproject:django
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vjjp-9r83-22rc | PyPI | django | >=1.4 <1.4.7 | 1.4.7 |
| GHSA-vjjp-9r83-22rc | PyPI | django | >=1.5 <1.5.3 | 1.5.3 |
| PYSEC-2013-20 | PyPI | django | >=1.4 <1.4.7 >=1.5 <1.5.3 | 1.4.7, 1.5.3 |