Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Jan 4, 2022 |
| Centos_linux | — | Upgrade rubygem-oauthUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-localeUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-powerbarUpgrade rubygem-unfUpgrade tfm-rubygem-unicodeUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-foreman_maintainUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-netrcUpgrade rubygem-highlineUpgrade satellite-cliUpgrade satellite-maintainUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade foreman-cliUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hashieUpgrade satellite-cloneUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-jwtUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-rest-clientUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-hashieUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-unf_extUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-runtimeUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-domain_nameUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unicode-debugsourceUpgrade rubygem-loggingUpgrade rubygem-unf_extUpgrade rubygem-rest-clientUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-mime-typesUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cliUpgrade rubygem-amazing_printUpgrade rubygem-clampUpgrade rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-highlineUpgrade rubygem-localeUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-amazing_printUpgrade rubygem-powerbarUpgrade rubygem-jwt | Jul 14, 2022 | Jan 5, 2022 |
| Debian | — | Upgrade python-django | Nov 18, 2022 | Jan 5, 2022 |
| Freebsd | — | Upgrade py37-django40Upgrade py39-django22Upgrade py37-django32Upgrade py37-django22Upgrade py39-django32Upgrade py38-django40Upgrade py38-django32Upgrade py39-django40Upgrade py38-django22 | Nov 4, 2022 | Jan 6, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-unfUpgrade rubygem-hammer_cliUpgrade rubygem-loggingUpgrade tfm-rubygem-amazing_printUpgrade rubygem-rest-clientUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade foreman-cliUpgrade rubygem-domain_nameUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-clampUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-clampUpgrade rubygem-hashieUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-mime-types-dataUpgrade rubygem-localeUpgrade rubygem-http-cookieUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-unfUpgrade rubygem-oauthUpgrade rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-apipie-bindingsUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-netrcUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade satellite-cloneUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_tasksUpgrade satellite-maintainUpgrade rubygem-unicodeUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-http-cookieUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade satellite-cliUpgrade rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-oauthUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-domain_nameUpgrade rubygem-netrcUpgrade tfm-rubygem-jwtUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-highlineUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-runtime | Jul 14, 2022 | Jan 5, 2022 |
| Rocky_linux | — | Upgrade libdb-debugsourceUpgrade libdb-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfo | Mar 12, 2024 | Jan 5, 2022 |
| Suse | — | Upgrade python3-django | Aug 9, 2024 | Jan 5, 2022 |
| Ubuntu | — | Upgrade python-djangoUpgrade python3-django | Jan 6, 2022 | Jan 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub