Lack of data validation - Path Traversal In python-django
Description
Django vulnerable to partial directory traversal via archives An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 12 | 3:3.2.25-0+deb12u1 | ||
debian 14 | 3:4.2.25-1 | ||
debian 11 | 2:2.2.28-1~deb11u9 | ||
debian 13 | 3:4.2.27-0+deb13u1 | ||
 pypi | 4.2.25, 5.1.13, 5.2.7 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3. 4. 5. 6.