Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Jan 4, 2022 |
| Centos_linux | — | Upgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-mime-types-dataUpgrade rubygem-unicodeUpgrade rubygem-unicode-display_widthUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-unicodeUpgrade rubygem-hammer_cli_katelloUpgrade satellite-maintainUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_openscapUpgrade satellite-cliUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-netrcUpgrade rubygem-oauthUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-clampUpgrade rubygem-highlineUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-powerbarUpgrade rubygem-foreman_maintainUpgrade rubygem-unfUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hashieUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-domain_nameUpgrade satellite-cloneUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-http-cookieUpgrade foreman-cliUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-mime-typesUpgrade rubygem-unf_extUpgrade rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-loggingUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-rest-clientUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-unicode-debugsourceUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-domain_nameUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-amazing_printUpgrade rubygem-powerbarUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-clampUpgrade rubygem-localeUpgrade rubygem-http-cookieUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-runtimeUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-hashieUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_virt_who_configure | Jul 14, 2022 | Jan 5, 2022 |
| Debian | — | Upgrade python-django | Nov 18, 2022 | Jan 5, 2022 |
| Freebsd | — | Upgrade py39-django40Upgrade py38-django22Upgrade py39-django32Upgrade py38-django32Upgrade py37-django32Upgrade py38-django40Upgrade py39-django22Upgrade py37-django22Upgrade py37-django40 | Nov 4, 2022 | Jan 6, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-localeUpgrade rubygem-http-cookieUpgrade rubygem-jwtUpgrade satellite-cloneUpgrade rubygem-unf_extUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-foreman_maintainUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-amazing_printUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-loggingUpgrade rubygem-hammer_cliUpgrade rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-mime-typesUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-clampUpgrade rubygem-unfUpgrade rubygem-clampUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-amazing_printUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-oauthUpgrade rubygem-hashieUpgrade foreman-cliUpgrade rubygem-unicode-debuginfoUpgrade tfm-runtimeUpgrade rubygem-mime-typesUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-unf_extUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-hashieUpgrade rubygem-hammer_cli_katelloUpgrade satellite-cliUpgrade rubygem-unicode-display_widthUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-http-cookieUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-rest-clientUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-highlineUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-unicodeUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-unicodeUpgrade rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-localeUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-jwtUpgrade rubygem-hammer_cli_foreman_openscap | Jul 14, 2022 | Jan 5, 2022 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxxUpgrade libdb-utils-debuginfoUpgrade libdb-debugsourceUpgrade libdb-debuginfo | Mar 12, 2024 | Jan 5, 2022 |
| Suse | — | Upgrade python3-django | Aug 9, 2024 | Jan 5, 2022 |
| Ubuntu | — | Upgrade python-djangoUpgrade python3-django | Jan 6, 2022 | Jan 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub