CVE-2009-2659
Django Admin Media Handler Vulnerable to Directory Traversal
The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.
Exploit likelihood
What each source reports
NVD Score used
The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.
- Record
CVE-2009-2659- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.
- Record
CVE-2009-2659- Updated
- 2026-11-02
EUVDEUVD-2009-0003 No score
The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.
- Record
EUVD-2009-0003- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9xg7-gg9m-rmq9
Django Admin Media Handler Vulnerable to Directory Traversal
The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.
- Record
GHSA-9xg7-gg9m-rmq9- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-9xg7-gg9m-rmq9
Django Admin Media Handler Vulnerable to Directory Traversal
The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.
- Record
GHSA-9xg7-gg9m-rmq9- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV No score
The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.
- Record
CVE-2009-2659- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-2659 No score
The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.
- Record
DEBIAN-CVE-2009-2659- Updated
- 2026-11-02
OSVPYSEC-2009-3 No score
The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected "static media files," which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.
- Record
PYSEC-2009-3- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
0.96.0 up to 0.96.4 | 0.96.4 |
djangoPyPI |
1.0 up to 1.0.3 | 1.0.3 |
python-djangoDebian:12 |
before 1.1-1 | 1.1-1 |
python-djangoDebian:13 |
before 1.1-1 | 1.1-1 |
python-djangoDebian:14 |
before 1.1-1 | 1.1-1 |
djangoPyPI |
1.0 up to 1.0.3, plus listed versions 1.0.11.0.2 |
1.0.3 |
djangoPyPI |
before 1.1, plus listed versions 1.0.11.0.21.0.31.0.4 |
1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2659 is a medium vulnerability (CVSS 5.0) in Django Project Django, published August 4, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.27%, the 83rd percentile. Fixed in django 0.96.4.
References
openwall.com/lists/oss-security/2009/07/29/2
securityfocus.com/bid/35859
code.djangoproject.com/changeset/11353
bugs.debian.org/cgi-bin/bugreport.cgi?bug=539134
redhat.com/archives/fedora-package-announce/2009-August/msg00055.html
secunia.com/advisories/36137
Show 11 moreShow less
djangoproject.com/weblog/2009/jul/28/security
nvd.nist.gov/vuln/detail/CVE-2009-2659
github.com/django/django/commit/da85d76fd6ca846f3b0ff414e042ddb5e62e2e69
web.archive.org/web/20111211001428/http://www.securityfocus.com/bid/35859
security-tracker.debian.org/tracker/CVE-2009-2659