cve.bz

CVE-2021-33203

4.9 mediumEPSS 2.7%

Medium (4.9). EPSS 2.7% chance of exploitation in the next 30 days. Fixed in django 2.2.24, 3.1.12, 3.2.4.

Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.

Severity

CVSS 3.1

4.9 medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS
2.7% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
CWE
CWE-22
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-68w8-qjq3-2gfmPyPIdjango<2.2.242.2.24
GHSA-68w8-qjq3-2gfmPyPIdjango>=3.0 <3.1.123.1.12
GHSA-68w8-qjq3-2gfmPyPIdjango>=3.2 <3.2.43.2.4
PYSEC-2021-98PyPIdjango<2.2.24
>=3.0 <3.1.12
>=3.2 <3.2.4		2.2.24, 3.1.12, 3.2.4

References

Check your stackJSON