CVE-2011-0698
Directory traversal in Django
Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.
Exploit likelihood
What each source reports
NVD Score used
Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.
- Record
CVE-2011-0698- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.
- Record
CVE-2011-0698- Updated
- 2026-11-02
EUVDEUVD-2011-0006 No score
Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.
- Record
EUVD-2011-0006- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7g9h-c88w-r7h2
Directory traversal in Django
Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.
- Record
GHSA-7g9h-c88w-r7h2- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-7g9h-c88w-r7h2
Directory traversal in Django
Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.
- Record
GHSA-7g9h-c88w-r7h2- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVPYSEC-2011-12 No score
Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.
- Record
PYSEC-2011-12- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
djangoPyPI |
1.1 up to 1.1.4 | 1.1.4 |
djangoPyPI |
1.2 up to 1.2.5 | 1.2.5 |
djangoPyPI |
1.1 up to 1.1.4, plus listed versions 1.1.11.1.21.1.3 |
1.1.4 |
djangoPyPI |
1.2 up to 1.2.5, plus listed versions 1.2.11.2.21.2.31.2.4 |
1.2.5 |
djangoPyPI |
1.1 up to 1.1.4, 1.2 up to 1.2.5, plus listed versions 1.1.11.1.21.1.31.2.11.2.21.2.31.2.4 |
1.1.41.2.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-0698 is a high vulnerability (CVSS 7.5) in Djangoproject Django, published February 14, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.86%, the 86th percentile. Fixed in django 1.1.4.
References
vupen.com/english/advisories/2011/0439
openwall.com/lists/oss-security/2011/02/09/6
secunia.com/advisories/43230
securityfocus.com/bid/46296
mandriva.com/security/advisories?name=MDVSA-2011:031
Show 9 moreShow less
djangoproject.com/weblog/2011/feb/08/security
nvd.nist.gov/vuln/detail/CVE-2011-0698
github.com/advisories/GHSA-7g9h-c88w-r7h2
web.archive.org/web/20110521033259/http://secunia.com/advisories/43230