Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Jan 4, 2022 |
| Centos_linux | — | Upgrade tfm-rubygem-hashieUpgrade rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-loggingUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unf_extUpgrade rubygem-fast_gettextUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-rest-clientUpgrade tfm-runtimeUpgrade rubygem-mime-typesUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-highlineUpgrade rubygem-http-cookieUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-powerbarUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-unfUpgrade rubygem-foreman_maintainUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foremanUpgrade satellite-maintainUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-domain_nameUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-jwtUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_katelloUpgrade satellite-cloneUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-http-cookieUpgrade foreman-cliUpgrade rubygem-unicode-display_widthUpgrade rubygem-unicodeUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade satellite-cliUpgrade rubygem-oauthUpgrade rubygem-netrcUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-highlineUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-clamp | Jul 14, 2022 | Jan 5, 2022 |
| Debian | — | Upgrade python-django | Nov 18, 2022 | Jan 5, 2022 |
| Freebsd | — | Upgrade py38-django32Upgrade py37-django22Upgrade py37-django40Upgrade py37-django32Upgrade py38-django40Upgrade py39-django22Upgrade py39-django32Upgrade py38-django22Upgrade py39-django40 | Nov 4, 2022 | Jan 6, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-netrcUpgrade satellite-cloneUpgrade rubygem-localeUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-mime-typesUpgrade rubygem-mime-types-dataUpgrade tfm-rubygem-clampUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-unf_extUpgrade rubygem-domain_nameUpgrade rubygem-hashieUpgrade rubygem-unfUpgrade foreman-cliUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-http-cookieUpgrade rubygem-foreman_maintainUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-jwtUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-loggingUpgrade rubygem-clampUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-highlineUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-rest-clientUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-oauthUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-loggingUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade satellite-maintainUpgrade rubygem-unicodeUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-highlineUpgrade tfm-runtimeUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-localeUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-oauthUpgrade rubygem-netrcUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unicode-debugsourceUpgrade satellite-cliUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-powerbarUpgrade tfm-rubygem-powerbarUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-unicode | Jul 14, 2022 | Jan 5, 2022 |
| Rocky_linux | — | Upgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debugsourceUpgrade libdb-debuginfo | Mar 12, 2024 | Jan 5, 2022 |
| Suse | — | Upgrade python3-django | Aug 9, 2024 | Jan 5, 2022 |
| Ubuntu | — | Upgrade python3-djangoUpgrade python-django | Jan 6, 2022 | Jan 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub