Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Jan 4, 2022 |
| Centos_linux | — | Upgrade rubygem-mime-typesUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-hashieUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-runtimeUpgrade tfm-rubygem-unf_extUpgrade rubygem-domain_nameUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-clampUpgrade tfm-rubygem-highlineUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-unfUpgrade rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-loggingUpgrade rubygem-amazing_printUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cliUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-highlineUpgrade tfm-rubygem-clampUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unfUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-oauthUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-netrcUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-rest-clientUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-domain_nameUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade satellite-cliUpgrade rubygem-netrcUpgrade rubygem-unicodeUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-localeUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-jwtUpgrade rubygem-hammer_cli_foreman_openscapUpgrade satellite-maintainUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-http-cookieUpgrade satellite-cloneUpgrade rubygem-hashieUpgrade foreman-cli | Jul 14, 2022 | Jan 5, 2022 |
| Debian | — | Upgrade python-django | Nov 18, 2022 | Jan 5, 2022 |
| Freebsd | — | Upgrade py37-django32Upgrade py37-django40Upgrade py39-django22Upgrade py38-django32Upgrade py38-django40Upgrade py39-django32Upgrade py37-django22Upgrade py39-django40Upgrade py38-django22 | Nov 4, 2022 | Jan 6, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-unfUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-fast_gettextUpgrade rubygem-http-cookieUpgrade satellite-cloneUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-loggingUpgrade rubygem-amazing_printUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-foreman_maintainUpgrade rubygem-loggingUpgrade tfm-rubygem-clampUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unf_extUpgrade rubygem-jwtUpgrade rubygem-localeUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-rest-clientUpgrade rubygem-highlineUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-unicode-display_widthUpgrade foreman-cliUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-amazing_printUpgrade rubygem-hashieUpgrade rubygem-domain_nameUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-clampUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-powerbarUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-mime-typesUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-unicodeUpgrade tfm-rubygem-hashieUpgrade satellite-cliUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-runtimeUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-http-cookieUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-oauthUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unicode-debugsourceUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-unicode-display_widthUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-unf_ext-debuginfo | Jul 14, 2022 | Jan 5, 2022 |
| Rocky_linux | — | Upgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxxUpgrade libdb-cxx-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debuginfoUpgrade libdb-debugsource | Mar 12, 2024 | Jan 5, 2022 |
| Suse | — | Upgrade python3-django | Aug 9, 2024 | Jan 5, 2022 |
| Ubuntu | — | Upgrade python-djangoUpgrade python3-django | Jan 6, 2022 | Jan 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub