CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCVE-2021-3281
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.
Severity
- EPSS
- 7.6% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- djangoproject:django
- fedoraproject:fedora
- netapp:snapcenter
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fvgf-6h6h-3322 | PyPI | django | >=2.2 <2.2.18 | 2.2.18 |
| GHSA-fvgf-6h6h-3322 | PyPI | django | >=3.1 <3.1.6 | 3.1.6 |
| GHSA-fvgf-6h6h-3322 | PyPI | django | >=3.0 <3.0.12 | 3.0.12 |
| PYSEC-2021-9 | PyPI | django | >=2.2 <2.2.18 >=3.0 <3.0.12 >=3.1 <3.1.6 | 2.2.18, 3.0.12, 3.1.6 |
References
- https://docs.djangoproject.com/en/3.1/releases/security/
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO/
- https://security.netapp.com/advisory/ntap-20210226-0004/
- https://www.djangoproject.com/weblog/2021/feb/01/security-releases/