CVE-2025-59682
Fixed in a distro release EPSS <1%CVSS 3.1
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.
Products: djangoproject django
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | django | 4.2.25 |
| PyPI | django | 5.1.13 |
| PyPI | django | 5.2.7 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | awx | 24.6.1-r17 |
| Debian 11 | python-django | 2:2.2.28-1~deb11u9 |
| Debian 12 | python-django | 3:3.2.25-0+deb12u1 |
| Debian 13 | python-django | 3:4.2.27-0+deb13u1 |
| Debian 14 | python-django | 3:4.2.25-1 |
| Red Hat ansible automation platform 2.5 | automation-gateway | 0:2.5.20251022-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway | 0:2.5.20251022-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-config | 0:2.5.20251022-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-config | 0:2.5.20251022-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-server | 0:2.5.20251022-1.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-server | 0:2.5.20251022-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.11-django | 0:4.2.25-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.11-django | 0:4.2.25-1.el8ap |
| Red Hat ansible automation platform 2.6 | automation-eda-controller | 0:1.2.1-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-eda-controller-base | 0:1.2.1-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-eda-controller-base-services | 0:1.2.1-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-eda-controller-event-stream-services | 0:1.2.1-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-eda-controller-worker-services | 0:1.2.1-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-platform-ui | 0:2.6.2-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.11-django | 0:4.2.25-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | python3.11-django | 0:4.2.25-1.el8ap |
| Red Hat ansible automation platform developer 2.5 | python3.11-django | 0:4.2.25-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | python3.11-django | 0:4.2.25-1.el9ap |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | python-Django | 4.2.11-150600.3.33.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | python-Django | 4.2.11-150600.3.33.1 |
| Ubuntu 22.04 LTS | python-django | 2:3.2.12-2ubuntu1.22 |
| Ubuntu 24.04 LTS | python-django | 3:4.2.11-1ubuntu1.11 |
| Ubuntu 25.10 | python-django | 3:5.2.4-1ubuntu2 |
| Ubuntu 26.04 LTS | python-django | 3:5.2.4-1ubuntu2 |
| Ubuntu Pro 14.04 LTS | python-django | 1.6.11-0ubuntu1.3+esm8 |
| Ubuntu Pro 16.04 LTS | python-django | 1.8.7-1ubuntu5.15+esm9 |
| Ubuntu Pro 18.04 LTS | python-django | 1:1.11.11-1ubuntu1.21+esm12 |
| Ubuntu Pro 20.04 LTS | python-django | 2:2.2.12-1ubuntu0.29+esm4 |
| openSUSE Leap 15.6 | python-Django | 4.2.11-150600.3.33.1 |
| openSUSE Leap 16.0 | python-Django | 5.2.4-bp160.3.1 |
| openSUSE Tumbleweed | python-Django | 5.2.7-1.1 |
| openSUSE Tumbleweed | python-Django4 | 4.2.25-1.1 |
| openSUSE Tumbleweed | python-Django5 | 5.2.16-1.1 |
| openSUSE Tumbleweed | python-Django6 | 6.0-1.1 |