CVE-2025-59682

Published: Oct 1, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.

Affected (3)

Products: Djangoproject: Django

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Djangoproject Django	From 4.2.0 to 4.2.25
Djangoproject Django	From 5.1 to 5.1.13
Djangoproject Django	From 5.2 to 5.2.7

Related CWEs

Relative Path Traversal

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

References (4)

https://docs.djangoproject.com/en/dev/releases/security/

Source: cve@mitre.org

Vendor Advisory

https://groups.google.com/g/django-announce

Source: cve@mitre.org

Release NotesVendor Advisory

https://www.djangoproject.com/weblog/2025/oct/01/security-releases/

Source: cve@mitre.org

Release NotesVendor Advisory

http://www.openwall.com/lists/oss-security/2025/10/01/3

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.