EUVD-2025-32692
GHSA-q95w-c7qg-hrff
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
4Description
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.
Analysis
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.
Technical Context
Path traversal allows an attacker to access files outside the intended directory by manipulating file paths with sequences like '../'.
Affected Products
Affected products: Djangoproject Django
Remediation
Validate and sanitize file path inputs. Use a whitelist of allowed files or directories. Implement chroot jails or containerization.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| upstream | released | 4.2.25,5.1.13,5.2.7 |
| bionic | released | 1:1.11.11-1ubuntu1.21+esm12 |
| focal | released | 2:2.2.12-1ubuntu0.29+esm4 |
| jammy | released | 2:3.2.12-2ubuntu1.22 |
| noble | released | 3:4.2.11-1ubuntu1.11 |
| plucky | released | 3:4.2.18-1ubuntu1.5 |
| trusty | released | 1.6.11-0ubuntu1.3+esm8 |
| xenial | released | 1.8.7-1ubuntu5.15+esm9 |
| questing | released | 3:5.2.4-1ubuntu2 |
Debian
Bug #1116979| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 2:2.2.28-1~deb11u9 | - |
| bullseye (security) | fixed | 2:2.2.28-1~deb11u12 | - |
| bookworm | fixed | 3:3.2.25-0+deb12u1 | - |
| bookworm (security) | fixed | 3:3.2.25-0+deb12u2 | - |
| trixie | fixed | 3:4.2.27-0+deb13u1 | - |
| trixie (security) | fixed | 3:4.2.28-0+deb13u1 | - |
| forky, sid | fixed | 3:4.2.29-1 | - |
| (unstable) | fixed | 3:4.2.25-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today