Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Jan 4, 2022 |
| Centos_linux | — | Upgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-oauthUpgrade satellite-cliUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-unfUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-domain_nameUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-jwtUpgrade rubygem-netrcUpgrade rubygem-unicode-display_widthUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_adminUpgrade satellite-maintainUpgrade tfm-rubygem-powerbarUpgrade rubygem-little-pluggerUpgrade rubygem-unicodeUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-localeUpgrade rubygem-foreman_maintainUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-netrcUpgrade satellite-cloneUpgrade rubygem-hashieUpgrade foreman-cliUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-http-cookieUpgrade rubygem-amazing_printUpgrade tfm-runtimeUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-loggingUpgrade tfm-rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-amazing_printUpgrade rubygem-powerbarUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-http-cookieUpgrade tfm-rubygem-highlineUpgrade rubygem-localeUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-unf_extUpgrade rubygem-clampUpgrade rubygem-domain_nameUpgrade rubygem-fast_gettextUpgrade rubygem-unf_extUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unicode-debugsourceUpgrade rubygem-rest-clientUpgrade tfm-rubygem-unfUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-logging | Jul 14, 2022 | Jan 5, 2022 |
| Debian | — | Upgrade python-django | Nov 18, 2022 | Jan 5, 2022 |
| Freebsd | — | Upgrade py37-django40Upgrade py39-django22Upgrade py37-django22Upgrade py38-django40Upgrade py38-django32Upgrade py39-django32Upgrade py37-django32Upgrade py39-django40Upgrade py38-django22 | Nov 4, 2022 | Jan 6, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade tfm-rubygem-loggingUpgrade tfm-rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unfUpgrade rubygem-mime-types-dataUpgrade rubygem-hashieUpgrade rubygem-rest-clientUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-domain_nameUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-amazing_printUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-clampUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-unfUpgrade foreman-cliUpgrade tfm-rubygem-hammer_cli_foremanUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-unf_extUpgrade rubygem-amazing_printUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-oauthUpgrade rubygem-unicode-debuginfoUpgrade rubygem-apipie-bindingsUpgrade tfm-rubygem-mime-typesUpgrade rubygem-jwtUpgrade rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade tfm-rubygem-little-pluggerUpgrade rubygem-foreman_maintainUpgrade rubygem-localeUpgrade satellite-cloneUpgrade tfm-rubygem-mime-types-dataUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unicodeUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-unf_extUpgrade rubygem-powerbarUpgrade rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-hashieUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-netrcUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-powerbarUpgrade rubygem-mime-typesUpgrade satellite-cliUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cliUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade satellite-maintainUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foremanUpgrade tfm-runtimeUpgrade rubygem-little-plugger | Jul 14, 2022 | Jan 5, 2022 |
| Rocky_linux | — | Upgrade libdb-cxxUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-debugsourceUpgrade libdb-debuginfo | Mar 12, 2024 | Jan 5, 2022 |
| Suse | — | Upgrade python3-django | Aug 9, 2024 | Jan 5, 2022 |
| Ubuntu | — | Upgrade python-djangoUpgrade python3-django | Jan 6, 2022 | Jan 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub