{"id":"CVE-2025-59682","aliases":["ALPINE-CVE-2025-59682","BIT-django-2025-59682","CLSA-2026-1787899840","CLSA-2026-1788166978","CLSA-2026-1789453540","CLSA-2026-1789454358","CLSA-2026-1789538853","CLSA-2026-1793695934","CLSA-2026-1793697667","CLSA-2026-1793868726","CLSA-2026-1793869737","CLSA-2026-1794216525","DEBIAN-CVE-2025-59682","DLA-4324-1","DSA-6117-1","DSA-6136-1","EUVD-2025-32692","GHSA-q95w-c7qg-hrff","MGASA-2025-0243","OESA-2025-2378","OESA-2025-2379","OESA-2025-2460","OESA-2025-2461","OESA-2025-2462","OESA-2025-2463","PYSEC-2026-1296","RHSA-2025:18979","RHSA-2025:19201","SUSE-SU-2025:03446-1","UBUNTU-CVE-2025-59682","USN-7794-1","openSUSE-SU-2025:15596-1","openSUSE-SU-2025:15598-1","openSUSE-SU-2025:20022-1","openSUSE-SU-2026:10005-1","openSUSE-SU-2026:11270-1"],"status":"published","title":"Django vulnerable to partial directory traversal via archives","description":"An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the \"startapp --template\" and \"startproject --template\" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00966,"percentile":0.61955,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-23"],"published":"2025-10-01T00:00:00Z","modified":"2026-11-09T19:15:15Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["4.2.25","5.1.13","5.2.7"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-django","fixed_in":["4.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-django","fixed_in":["4.2.25-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-django","fixed_in":["4.2.25-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"django","fixed_in":["4.2.25","5.1.13","5.2.7"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"django","fixed_in":["4.2.post8+tuxcare","5.0.2.post15+tuxcare","5.0.1.post15+tuxcare","5.0.post21+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["3:3.2.25-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["3:4.2.27-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["3:4.2.25-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-django","fixed_in":["1.6.11-0ubuntu1.3+esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-django","fixed_in":["1.8.7-1ubuntu5.15+esm9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-django","fixed_in":["1:1.11.11-1ubuntu1.21+esm12"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-django","fixed_in":["2:2.2.12-1ubuntu0.29+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"python-django","fixed_in":["2:3.2.12-2ubuntu1.22"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-django","fixed_in":["3:4.2.11-1ubuntu1.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"python-django","fixed_in":["3:5.2.4-1ubuntu2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"python-django","fixed_in":["3:5.2.4-1ubuntu2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.25"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1"},{"fixed":"5.1.13"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2"},{"fixed":"5.2.7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.25-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.25-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"django","ranges":[{"type":"SEMVER","events":[{"introduced":"4.2.0"},{"fixed":"4.2.25"},{"introduced":"5.1.0"},{"fixed":"5.1.13"},{"introduced":"5.2.0"},{"fixed":"5.2.7"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.post8+tuxcare"}]}],"versions":["4.2","4.2.post1+tuxcare","4.2.post2+tuxcare","4.2.post3+tuxcare","4.2.post4+tuxcare","4.2.post5+tuxcare","4.2.post6+tuxcare","4.2.post7+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.10"},{"fixed":"5.1.10.post3+tuxcare"}]}],"versions":["5.1.10","5.1.10.post1+tuxcare","5.1.10.post2+tuxcare"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.9"},{"fixed":"5.1.9.post6+tuxcare"}]}],"versions":["5.1.9","5.1.9.post1+tuxcare","5.1.9.post2+tuxcare","5.1.9.post3+tuxcare","5.1.9.post4+tuxcare","5.1.9.post5+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.4"},{"fixed":"5.1.4.post7+tuxcare"}]}],"versions":["5.1.4","5.1.4.post1+tuxcare","5.1.4.post2+tuxcare","5.1.4.post3+tuxcare","5.1.4.post4+tuxcare","5.1.4.post5+tuxcare","5.1.4.post6+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1"},{"fixed":"5.1.post10+tuxcare"}]}],"versions":["5.1","5.1.post1+tuxcare","5.1.post2+tuxcare","5.1.post3+tuxcare","5.1.post4+tuxcare","5.1.post5+tuxcare","5.1.post6+tuxcare","5.1.post7+tuxcare","5.1.post8+tuxcare","5.1.post9+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"4.0.post27+tuxcare"}]}],"versions":["4.0","4.0.post1+tuxcare","4.0.post10+tuxcare","4.0.post11+tuxcare","4.0.post12+tuxcare","4.0.post13+tuxcare","4.0.post14+tuxcare","4.0.post15+tuxcare","4.0.post16+tuxcare","4.0.post17+tuxcare","4.0.post18+tuxcare","4.0.post19+tuxcare","4.0.post2+tuxcare","4.0.post20+tuxcare","4.0.post21+tuxcare","4.0.post22+tuxcare","4.0.post23+tuxcare","4.0.post24+tuxcare","4.0.post25+tuxcare","4.0.post26+tuxcare","4.0.post3+tuxcare","4.0.post4+tuxcare","4.0.post5+tuxcare","4.0.post6+tuxcare","4.0.post7+tuxcare","4.0.post8+tuxcare","4.0.post9+tuxcare"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.2"},{"fixed":"5.0.2.post15+tuxcare"}]}],"versions":["5.0.2","5.0.2.post1+tuxcare","5.0.2.post10+tuxcare","5.0.2.post11+tuxcare","5.0.2.post12+tuxcare","5.0.2.post13+tuxcare","5.0.2.post14+tuxcare","5.0.2.post2+tuxcare","5.0.2.post3+tuxcare","5.0.2.post4+tuxcare","5.0.2.post5+tuxcare","5.0.2.post6+tuxcare","5.0.2.post7+tuxcare","5.0.2.post8+tuxcare","5.0.2.post9+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.1"},{"fixed":"5.0.1.post15+tuxcare"}]}],"versions":["5.0.1","5.0.1.post1+tuxcare","5.0.1.post10+tuxcare","5.0.1.post11+tuxcare","5.0.1.post12+tuxcare","5.0.1.post13+tuxcare","5.0.1.post14+tuxcare","5.0.1.post2+tuxcare","5.0.1.post3+tuxcare","5.0.1.post4+tuxcare","5.0.1.post5+tuxcare","5.0.1.post6+tuxcare","5.0.1.post7+tuxcare","5.0.1.post8+tuxcare","5.0.1.post9+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.25"},{"fixed":"3.2.25.post16+tuxcare"}]}],"versions":["3.2.25","3.2.25.post1+tuxcare","3.2.25.post10+tuxcare","3.2.25.post11+tuxcare","3.2.25.post12+tuxcare","3.2.25.post13+tuxcare","3.2.25.post14+tuxcare","3.2.25.post15+tuxcare","3.2.25.post2+tuxcare","3.2.25.post3+tuxcare","3.2.25.post4+tuxcare","3.2.25.post5+tuxcare","3.2.25.post6+tuxcare","3.2.25.post7+tuxcare","3.2.25.post8+tuxcare","3.2.25.post9+tuxcare"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.0.post21+tuxcare"}]}],"versions":["5.0","5.0.post1+tuxcare","5.0.post10+tuxcare","5.0.post11+tuxcare","5.0.post12+tuxcare","5.0.post13+tuxcare","5.0.post14+tuxcare","5.0.post15+tuxcare","5.0.post16+tuxcare","5.0.post17+tuxcare","5.0.post18+tuxcare","5.0.post19+tuxcare","5.0.post2+tuxcare","5.0.post20+tuxcare","5.0.post3+tuxcare","5.0.post4+tuxcare","5.0.post5+tuxcare","5.0.post6+tuxcare","5.0.post7+tuxcare","5.0.post8+tuxcare","5.0.post9+tuxcare"]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:3.2.25-0+deb12u1"}]}],"versions":["3:3.2.19-1","3:3.2.19-1+deb12u1","3:3.2.19-1+deb12u1~bpo11+1","3:3.2.19-1+deb12u2","3:3.2.20-1","3:3.2.20-1.1","3:3.2.21-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.27-0+deb13u1"}]}],"versions":["3:4.2.23-1","3:4.2.24-1","3:4.2.25-1","3:4.2.25-2","3:4.2.26-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.25-1"}]}],"versions":["3:4.2.23-1","3:4.2.24-1"]},{"source":"osv","ecosystem":"Debian:11","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.28-1~deb11u9"}]}],"versions":["2:2.2.24-1","2:2.2.25-1~deb11u1","2:2.2.26-1~deb11u1","2:2.2.28-1~deb11u1","2:2.2.28-1~deb11u2","2:2.2.28-1~deb11u3","2:2.2.28-1~deb11u4","2:2.2.28-1~deb11u5","2:2.2.28-1~deb11u6","2:2.2.28-1~deb11u7","2:2.2.28-1~deb11u8"],"bundled":2},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.27-0+deb13u1"}]}],"versions":["3:4.2.23-1","3:4.2.24-1","3:4.2.25-1","3:4.2.25-2","3:4.2.26-1"],"bundled":6},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:3.2.25-0+deb12u1"}]}],"versions":["3:3.2.19-1","3:3.2.19-1+deb12u1","3:3.2.19-1+deb12u1~bpo11+1","3:3.2.19-1+deb12u2","3:3.2.20-1","3:3.2.20-1.1","3:3.2.21-1"],"bundled":23},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.25"}]}],"versions":["4.2","4.2.1","4.2.10","4.2.11","4.2.12","4.2.13","4.2.14","4.2.15","4.2.16","4.2.17","4.2.18","4.2.19","4.2.2","4.2.20","4.2.21","4.2.22","4.2.23","4.2.24","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1"},{"fixed":"5.1.13"}]}],"versions":["5.1","5.1.1","5.1.10","5.1.11","5.1.12","5.1.2","5.1.3","5.1.4","5.1.5","5.1.6","5.1.7","5.1.8","5.1.9"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2"},{"fixed":"5.2.7"}]}],"versions":["5.2","5.2.1","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.13-1.7.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-9.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-9.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-9.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-9.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-9.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.27-19.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.25"},{"introduced":"5.1"},{"fixed":"5.1.13"},{"introduced":"5.2"},{"fixed":"5.2.7"}]}],"versions":["4.2","4.2.1","4.2.10","4.2.11","4.2.12","4.2.13","4.2.14","4.2.15","4.2.16","4.2.17","4.2.18","4.2.19","4.2.2","4.2.20","4.2.21","4.2.22","4.2.23","4.2.24","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9","5.1","5.1.1","5.1.10","5.1.11","5.1.12","5.1.2","5.1.3","5.1.4","5.1.5","5.1.6","5.1.7","5.1.8","5.1.9","5.2","5.2.1","5.2.2","5.2.3","5.2.4","5.2.5","5.2.6"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20251022-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20251022-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20251022-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20251022-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20251022-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20251022-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.25-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.25-1.el8ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.25-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.25-1.el9ap"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-base-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-event-stream-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-eda-controller-worker-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.1-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-platform-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.25-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.25-1.el9ap"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-150600.3.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-150600.3.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-150600.3.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-0ubuntu1.3+esm8"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11","1.6.1-2ubuntu0.12","1.6.1-2ubuntu0.13","1.6.1-2ubuntu0.14","1.6.1-2ubuntu0.15","1.6.1-2ubuntu0.16","1.6.11-0ubuntu1","1.6.11-0ubuntu1.1","1.6.11-0ubuntu1.2","1.6.11-0ubuntu1.3","1.6.11-0ubuntu1.3+esm1","1.6.11-0ubuntu1.3+esm2","1.6.11-0ubuntu1.3+esm3","1.6.11-0ubuntu1.3+esm4","1.6.11-0ubuntu1.3+esm5","1.6.11-0ubuntu1.3+esm6","1.6.11-0ubuntu1.3+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1ubuntu5.15+esm9"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2","1.8.7-1ubuntu5.4","1.8.7-1ubuntu5.5","1.8.7-1ubuntu5.6","1.8.7-1ubuntu5.7","1.8.7-1ubuntu5.8","1.8.7-1ubuntu5.9","1.8.7-1ubuntu5.10","1.8.7-1ubuntu5.11","1.8.7-1ubuntu5.12","1.8.7-1ubuntu5.13","1.8.7-1ubuntu5.14","1.8.7-1ubuntu5.15","1.8.7-1ubuntu5.15+esm1","1.8.7-1ubuntu5.15+esm3","1.8.7-1ubuntu5.15+esm4","1.8.7-1ubuntu5.15+esm5","1.8.7-1ubuntu5.15+esm6","1.8.7-1ubuntu5.15+esm7","1.8.7-1ubuntu5.15+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.21+esm12"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4","1:1.11.11-1ubuntu1.5","1:1.11.11-1ubuntu1.6","1:1.11.11-1ubuntu1.7","1:1.11.11-1ubuntu1.8","1:1.11.11-1ubuntu1.9","1:1.11.11-1ubuntu1.10","1:1.11.11-1ubuntu1.11","1:1.11.11-1ubuntu1.12","1:1.11.11-1ubuntu1.13","1:1.11.11-1ubuntu1.14","1:1.11.11-1ubuntu1.15","1:1.11.11-1ubuntu1.16","1:1.11.11-1ubuntu1.17","1:1.11.11-1ubuntu1.18","1:1.11.11-1ubuntu1.19","1:1.11.11-1ubuntu1.20","1:1.11.11-1ubuntu1.21","1:1.11.11-1ubuntu1.21+esm1","1:1.11.11-1ubuntu1.21+esm2","1:1.11.11-1ubuntu1.21+esm3","1:1.11.11-1ubuntu1.21+esm4","1:1.11.11-1ubuntu1.21+esm5","1:1.11.11-1ubuntu1.21+esm6","1:1.11.11-1ubuntu1.21+esm7","1:1.11.11-1ubuntu1.21+esm8","1:1.11.11-1ubuntu1.21+esm9","1:1.11.11-1ubuntu1.21+esm10","1:1.11.11-1ubuntu1.21+esm11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.12-1ubuntu0.29+esm4"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2","2:2.2.12-1ubuntu0.3","2:2.2.12-1ubuntu0.4","2:2.2.12-1ubuntu0.5","2:2.2.12-1ubuntu0.6","2:2.2.12-1ubuntu0.7","2:2.2.12-1ubuntu0.8","2:2.2.12-1ubuntu0.9","2:2.2.12-1ubuntu0.10","2:2.2.12-1ubuntu0.11","2:2.2.12-1ubuntu0.12","2:2.2.12-1ubuntu0.13","2:2.2.12-1ubuntu0.14","2:2.2.12-1ubuntu0.15","2:2.2.12-1ubuntu0.16","2:2.2.12-1ubuntu0.17","2:2.2.12-1ubuntu0.18","2:2.2.12-1ubuntu0.19","2:2.2.12-1ubuntu0.20","2:2.2.12-1ubuntu0.21","2:2.2.12-1ubuntu0.22","2:2.2.12-1ubuntu0.23","2:2.2.12-1ubuntu0.24","2:2.2.12-1ubuntu0.25","2:2.2.12-1ubuntu0.26","2:2.2.12-1ubuntu0.27","2:2.2.12-1ubuntu0.28","2:2.2.12-1ubuntu0.29","2:2.2.12-1ubuntu0.29+esm1","2:2.2.12-1ubuntu0.29+esm2","2:2.2.12-1ubuntu0.29+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.2.12-2ubuntu1.22"}]}],"versions":["2:2.2.24-1ubuntu1","2:3.2.12-2","2:3.2.12-2ubuntu1","2:3.2.12-2ubuntu1.1","2:3.2.12-2ubuntu1.2","2:3.2.12-2ubuntu1.3","2:3.2.12-2ubuntu1.4","2:3.2.12-2ubuntu1.5","2:3.2.12-2ubuntu1.6","2:3.2.12-2ubuntu1.7","2:3.2.12-2ubuntu1.8","2:3.2.12-2ubuntu1.9","2:3.2.12-2ubuntu1.10","2:3.2.12-2ubuntu1.11","2:3.2.12-2ubuntu1.12","2:3.2.12-2ubuntu1.13","2:3.2.12-2ubuntu1.14","2:3.2.12-2ubuntu1.15","2:3.2.12-2ubuntu1.16","2:3.2.12-2ubuntu1.17","2:3.2.12-2ubuntu1.18","2:3.2.12-2ubuntu1.19","2:3.2.12-2ubuntu1.20","2:3.2.12-2ubuntu1.21"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.11-1ubuntu1.11"}]}],"versions":["3:4.2.4-1ubuntu2","3:4.2.8-1","3:4.2.9-1","3:4.2.11-1","3:4.2.11-1ubuntu1","3:4.2.11-1ubuntu1.1","3:4.2.11-1ubuntu1.2","3:4.2.11-1ubuntu1.3","3:4.2.11-1ubuntu1.4","3:4.2.11-1ubuntu1.5","3:4.2.11-1ubuntu1.6","3:4.2.11-1ubuntu1.7","3:4.2.11-1ubuntu1.8","3:4.2.11-1ubuntu1.9","3:4.2.11-1ubuntu1.10"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.2.4-1ubuntu2"}]}],"versions":["3:4.2.18-1ubuntu1","3:4.2.18-1ubuntu1.1","3:5.2.4-1","3:5.2.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:5.2.4-1ubuntu2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-0ubuntu1.3+esm8"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11","1.6.1-2ubuntu0.12","1.6.1-2ubuntu0.13","1.6.1-2ubuntu0.14","1.6.1-2ubuntu0.15","1.6.1-2ubuntu0.16","1.6.11-0ubuntu1","1.6.11-0ubuntu1.1","1.6.11-0ubuntu1.2","1.6.11-0ubuntu1.3","1.6.11-0ubuntu1.3+esm1","1.6.11-0ubuntu1.3+esm2","1.6.11-0ubuntu1.3+esm3","1.6.11-0ubuntu1.3+esm4","1.6.11-0ubuntu1.3+esm5","1.6.11-0ubuntu1.3+esm6","1.6.11-0ubuntu1.3+esm7"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1ubuntu5.15+esm9"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2","1.8.7-1ubuntu5.4","1.8.7-1ubuntu5.5","1.8.7-1ubuntu5.6","1.8.7-1ubuntu5.7","1.8.7-1ubuntu5.8","1.8.7-1ubuntu5.9","1.8.7-1ubuntu5.10","1.8.7-1ubuntu5.11","1.8.7-1ubuntu5.12","1.8.7-1ubuntu5.13","1.8.7-1ubuntu5.14","1.8.7-1ubuntu5.15","1.8.7-1ubuntu5.15+esm1","1.8.7-1ubuntu5.15+esm3","1.8.7-1ubuntu5.15+esm4","1.8.7-1ubuntu5.15+esm5","1.8.7-1ubuntu5.15+esm6","1.8.7-1ubuntu5.15+esm7","1.8.7-1ubuntu5.15+esm8"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.21+esm12"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4","1:1.11.11-1ubuntu1.5","1:1.11.11-1ubuntu1.6","1:1.11.11-1ubuntu1.7","1:1.11.11-1ubuntu1.8","1:1.11.11-1ubuntu1.9","1:1.11.11-1ubuntu1.10","1:1.11.11-1ubuntu1.11","1:1.11.11-1ubuntu1.12","1:1.11.11-1ubuntu1.13","1:1.11.11-1ubuntu1.14","1:1.11.11-1ubuntu1.15","1:1.11.11-1ubuntu1.16","1:1.11.11-1ubuntu1.17","1:1.11.11-1ubuntu1.18","1:1.11.11-1ubuntu1.19","1:1.11.11-1ubuntu1.20","1:1.11.11-1ubuntu1.21","1:1.11.11-1ubuntu1.21+esm1","1:1.11.11-1ubuntu1.21+esm2","1:1.11.11-1ubuntu1.21+esm3","1:1.11.11-1ubuntu1.21+esm4","1:1.11.11-1ubuntu1.21+esm5","1:1.11.11-1ubuntu1.21+esm6","1:1.11.11-1ubuntu1.21+esm7","1:1.11.11-1ubuntu1.21+esm8","1:1.11.11-1ubuntu1.21+esm9","1:1.11.11-1ubuntu1.21+esm10","1:1.11.11-1ubuntu1.21+esm11"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.12-1ubuntu0.29+esm4"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2","2:2.2.12-1ubuntu0.3","2:2.2.12-1ubuntu0.4","2:2.2.12-1ubuntu0.5","2:2.2.12-1ubuntu0.6","2:2.2.12-1ubuntu0.7","2:2.2.12-1ubuntu0.8","2:2.2.12-1ubuntu0.9","2:2.2.12-1ubuntu0.10","2:2.2.12-1ubuntu0.11","2:2.2.12-1ubuntu0.12","2:2.2.12-1ubuntu0.13","2:2.2.12-1ubuntu0.14","2:2.2.12-1ubuntu0.15","2:2.2.12-1ubuntu0.16","2:2.2.12-1ubuntu0.17","2:2.2.12-1ubuntu0.18","2:2.2.12-1ubuntu0.19","2:2.2.12-1ubuntu0.20","2:2.2.12-1ubuntu0.21","2:2.2.12-1ubuntu0.22","2:2.2.12-1ubuntu0.23","2:2.2.12-1ubuntu0.24","2:2.2.12-1ubuntu0.25","2:2.2.12-1ubuntu0.26","2:2.2.12-1ubuntu0.27","2:2.2.12-1ubuntu0.28","2:2.2.12-1ubuntu0.29","2:2.2.12-1ubuntu0.29+esm1","2:2.2.12-1ubuntu0.29+esm2","2:2.2.12-1ubuntu0.29+esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.2.12-2ubuntu1.22"}]}],"versions":["2:2.2.24-1ubuntu1","2:3.2.12-2","2:3.2.12-2ubuntu1","2:3.2.12-2ubuntu1.1","2:3.2.12-2ubuntu1.2","2:3.2.12-2ubuntu1.3","2:3.2.12-2ubuntu1.4","2:3.2.12-2ubuntu1.5","2:3.2.12-2ubuntu1.6","2:3.2.12-2ubuntu1.7","2:3.2.12-2ubuntu1.8","2:3.2.12-2ubuntu1.9","2:3.2.12-2ubuntu1.10","2:3.2.12-2ubuntu1.11","2:3.2.12-2ubuntu1.12","2:3.2.12-2ubuntu1.13","2:3.2.12-2ubuntu1.14","2:3.2.12-2ubuntu1.15","2:3.2.12-2ubuntu1.16","2:3.2.12-2ubuntu1.17","2:3.2.12-2ubuntu1.18","2:3.2.12-2ubuntu1.19","2:3.2.12-2ubuntu1.20","2:3.2.12-2ubuntu1.21"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.11-1ubuntu1.11"}]}],"versions":["3:4.2.4-1ubuntu2","3:4.2.8-1","3:4.2.9-1","3:4.2.11-1","3:4.2.11-1ubuntu1","3:4.2.11-1ubuntu1.1","3:4.2.11-1ubuntu1.2","3:4.2.11-1ubuntu1.3","3:4.2.11-1ubuntu1.4","3:4.2.11-1ubuntu1.5","3:4.2.11-1ubuntu1.6","3:4.2.11-1ubuntu1.7","3:4.2.11-1ubuntu1.8","3:4.2.11-1ubuntu1.9","3:4.2.11-1ubuntu1.10"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.25-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.7-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4-bp160.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-1.1"}]}],"bundled":70},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.16-1.1"}]}],"bundled":93}],"products":[{"vendor":"djangoproject","product":"django"}],"references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["Vendor Advisory","advisory","web"]},{"url":"https://groups.google.com/g/django-announce","tags":["Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://www.djangoproject.com/weblog/2025/oct/01/security-releases/","tags":["Release Notes","Vendor Advisory","advisory","article"]},{"url":"http://www.openwall.com/lists/oss-security/2025/10/01/3","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59682","tags":["web","advisory"]},{"url":"https://docs.djangoproject.com/en/dev/releases/security","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2025/oct/01/security-releases","tags":["web"]},{"url":"https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e","tags":["web"]},{"url":"https://github.com/django/django/commit/924a0c092e65fa2d0953fd1855d2dc8786d94de2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q95w-c7qg-hrff","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-59682","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59682.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-59682","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0243.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34645","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/10/01/3","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2378","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59681","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2379","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2460","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2461","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2462","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2463","tags":["advisory"]},{"url":"https://pypi.org/project/django","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2025:18979","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2397901","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2400450","tags":["report"]},{"url":"https://issues.redhat.com/browse/AAP-56352","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_18979.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59343","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59343","tags":["advisory"]},{"url":"https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09","tags":["article"]},{"url":"https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59682","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59682","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2025:19201","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2392834","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2392835","tags":["report"]},{"url":"https://issues.redhat.com/browse/AAP-49448","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19201.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9907","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9907","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9907","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9908","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9908","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503446-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250485","tags":["report"]},{"url":"https://bugzilla.suse.com/1250487","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59682","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-59682","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7794-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-59681","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-36053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-26699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-57833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8404","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-59682","description":"An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the \"startapp --template\" and \"startproject --template\" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.","status":"published","published":"2025-10-01T00:00:00Z","modified":"2025-11-04T21:13:56.342Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:32:47.812946Z"}],"euvd":[{"id":"EUVD-2025-32692","description":"An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the \"startapp --template\" and \"startproject --template\" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.","status":"published","published":"2025-10-01T00:00:00Z","modified":"2025-11-04T21:13:56Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T19:49:20.707326Z"}],"ghsa":[{"id":"GHSA-q95w-c7qg-hrff","title":"Django vulnerable to partial directory traversal via archives","description":"An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the \"startapp --template\" and \"startproject --template\" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.","status":"published","published":"2025-10-01T21:31:22Z","modified":"2025-11-05T20:47:26Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:39:07.0252Z"}],"nvd":[{"id":"CVE-2025-59682","description":"An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the \"startapp --template\" and \"startproject --template\" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.","status":"published","published":"2025-10-01T19:15:37.007Z","modified":"2026-10-12T15:10:00.207Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:11:34.090044Z"}],"osv":[{"id":"ALPINE-CVE-2025-59682","description":"An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the \"startapp --template\" and \"startproject --template\" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.","status":"published","published":"2025-10-01T19:15:37.007Z","modified":"2026-11-03T06:32:51.180285067Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2025-59682","description":"An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the \"startapp --template\" and \"startproject --template\" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.","status":"published","published":"2025-10-01T00:00:00Z","modified":"2026-10-28T02:30:35.525045235Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T15:44:51.516975Z"},{"id":"DEBIAN-CVE-2025-59682","description":"An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the \"startapp --template\" and \"startproject --template\" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.","status":"published","published":"2025-10-01T19:15:37.007Z","modified":"2026-10-13T09:47:41.335819968Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"GHSA-q95w-c7qg-hrff","title":"Django vulnerable to partial directory traversal via archives","description":"An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the \"startapp --template\" and \"startproject --template\" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.","status":"published","published":"2025-10-01T21:31:22Z","modified":"2026-09-10T03:50:30.221015968Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"OESA-2025-2378","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods on MySQL and MariaDB.(CVE-2025-59681)\n\nA critical vulnerability was found in Django up to 4.2.24/5.1.12/5.2.6. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. Upgrading to version 4.2.25, 5.1.13 or 5.2.7 eliminates this vulnerability.(CVE-2025-59682)","status":"published","published":"2025-10-11T11:09:27Z","modified":"2026-08-18T01:19:13.353186226Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2379","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods on MySQL and MariaDB.(CVE-2025-59681)\n\nA critical vulnerability was found in Django up to 4.2.24/5.1.12/5.2.6. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. Upgrading to version 4.2.25, 5.1.13 or 5.2.7 eliminates this vulnerability.(CVE-2025-59682)","status":"published","published":"2025-10-11T11:09:27Z","modified":"2026-08-18T01:19:12.642186022Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2460","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods on MySQL and MariaDB.(CVE-2025-59681)\n\nA critical vulnerability was found in Django up to 4.2.24/5.1.12/5.2.6. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. Upgrading to version 4.2.25, 5.1.13 or 5.2.7 eliminates this vulnerability.(CVE-2025-59682)","status":"published","published":"2025-10-17T11:09:33Z","modified":"2026-08-18T01:19:14.86539446Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2461","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods on MySQL and MariaDB.(CVE-2025-59681)\n\nA critical vulnerability was found in Django up to 4.2.24/5.1.12/5.2.6. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. Upgrading to version 4.2.25, 5.1.13 or 5.2.7 eliminates this vulnerability.(CVE-2025-59682)","status":"published","published":"2025-10-17T11:09:33Z","modified":"2026-08-18T01:19:14.384275037Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2462","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods on MySQL and MariaDB.(CVE-2025-59681)\n\nA critical vulnerability was found in Django up to 4.2.24/5.1.12/5.2.6. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. Upgrading to version 4.2.25, 5.1.13 or 5.2.7 eliminates this vulnerability.(CVE-2025-59682)","status":"published","published":"2025-10-17T11:09:33Z","modified":"2026-08-18T01:19:14.461038146Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2463","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\n\nAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods on MySQL and MariaDB.(CVE-2025-59681)\n\nA critical vulnerability was found in Django up to 4.2.24/5.1.12/5.2.6. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. Upgrading to version 4.2.25, 5.1.13 or 5.2.7 eliminates this vulnerability.(CVE-2025-59682)","status":"published","published":"2025-10-17T11:09:33Z","modified":"2026-08-18T01:19:14.890490116Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"PYSEC-2026-1296","title":"Django vulnerable to partial directory traversal via archives","description":"An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the \"startapp --template\" and \"startproject --template\" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.","status":"published","published":"2026-07-07T16:03:06.157235Z","modified":"2026-07-07T17:56:06.86026856Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"RHSA-2025:18979","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2025-10-23T10:05:35Z","modified":"2026-09-22T10:04:50Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:19201","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","status":"published","published":"2025-10-29T10:04:30Z","modified":"2026-09-22T10:04:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"UBUNTU-CVE-2025-59682","description":"An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the \"startapp --template\" and \"startproject --template\" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.","status":"published","published":"2025-10-01T14:00:00Z","modified":"2026-05-20T16:23:38.605753914Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"BIT-django-2025-59682","description":"An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the \"startapp --template\" and \"startproject --template\" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.","status":"published","published":"2025-10-23T08:40:14.229Z","modified":"2026-09-08T08:46:33.667176705Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"CLSA-2026-1787899840","title":"TuxCare security update for django (1 CVE)","description":"TuxCare rebuilt django to address 1 CVE. Fixed in 4.2.post8+tuxcare.","status":"published","published":"2026-08-28T06:50:40Z","modified":"2026-10-15T09:48:05.765180757Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788166978","title":"TuxCare security update for django (6 CVEs)","description":"TuxCare rebuilt django to address 6 CVEs. Fixed in 5.1.10.post3+tuxcare.","status":"published","published":"2026-08-31T09:02:58Z","modified":"2026-10-15T09:47:40.879748796Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1789453540","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.9.post6+tuxcare.","status":"published","published":"2026-09-15T06:25:40Z","modified":"2026-10-15T09:48:01.814291493Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789454358","title":"TuxCare security update for django (2 CVEs)","description":"TuxCare rebuilt django to address 2 CVEs. Fixed in 5.1.4.post7+tuxcare.","status":"published","published":"2026-09-15T06:39:18Z","modified":"2026-10-15T09:48:01.785929043Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789538853","title":"TuxCare security update for django (3 CVEs)","description":"TuxCare rebuilt django to address 3 CVEs. Fixed in 5.1.post10+tuxcare.","status":"published","published":"2026-09-16T06:07:33Z","modified":"2026-10-15T09:48:01.971848558Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1793695934","title":"TuxCare security update for django (6 CVEs)","description":"TuxCare rebuilt django to address 6 CVEs. Fixed in 4.0.post27+tuxcare.","status":"published","published":"2026-11-03T09:52:15Z","modified":"2026-11-03T13:30:03.157133717Z","updated_at":"2026-11-03T14:04:50.729288Z"},{"id":"CLSA-2026-1793697667","title":"TuxCare security update for django (1 CVE)","description":"TuxCare rebuilt django to address 1 CVE. Fixed in 5.0.2.post15+tuxcare.","status":"published","published":"2026-11-03T10:21:08Z","modified":"2026-11-03T13:30:03.170955389Z","updated_at":"2026-11-03T14:04:50.729288Z"},{"id":"CLSA-2026-1793868726","title":"TuxCare security update for django (1 CVE)","description":"TuxCare rebuilt django to address 1 CVE. Fixed in 5.0.1.post15+tuxcare.","status":"published","published":"2026-11-05T09:52:06Z","modified":"2026-11-05T13:15:15.975985713Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793869737","title":"TuxCare security update for django (6 CVEs)","description":"TuxCare rebuilt django to address 6 CVEs. Fixed in 3.2.25.post16+tuxcare.","status":"published","published":"2026-11-05T10:08:58Z","modified":"2026-11-05T13:15:16.276359196Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1794216525","title":"TuxCare security update for django (1 CVE)","description":"TuxCare rebuilt django to address 1 CVE. Fixed in 5.0.post21+tuxcare.","status":"published","published":"2026-11-09T10:28:46Z","modified":"2026-11-09T19:15:15.029711233Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"DLA-4324-1","title":"python-django - security update","status":"published","published":"2025-10-07T00:00:00Z","modified":"2025-10-07T22:18:09.55247Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-6117-1","title":"python-django - security update","status":"published","published":"2026-01-31T00:00:00Z","modified":"2026-01-31T13:30:09.574225Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"DSA-6136-1","title":"python-django - security update","status":"published","published":"2026-02-15T00:00:00Z","modified":"2026-02-15T22:15:22.938868Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0243","title":"Updated python-django packages fix a security vulnerability","description":"An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13,\nand 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(),\nQuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection\nin column aliases, when using a suitably crafted dictionary, with\ndictionary expansion, as the **kwargs passed to these methods (on MySQL\nand MariaDB). (CVE-2025-59681)\nAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13,\nand 5.2 before 5.2.7. The django.utils.archive.extract() function, used\nby the \"startapp --template\" and \"startproject --template\" commands,\nallows partial directory traversal via an archive with file paths\nsharing a common prefix with the target directory. (CVE-2025-59682)\n","status":"published","published":"2025-10-22T20:07:31Z","modified":"2026-04-16T04:41:58.822746682Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15596-1","title":"python311-Django4-4.2.25-1.1 on GA media","description":"These are all security issues fixed in the python311-Django4-4.2.25-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-02T00:00:00Z","modified":"2026-03-23T04:53:58.83155Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15598-1","title":"python311-Django-5.2.7-1.1 on GA media","description":"These are all security issues fixed in the python311-Django-5.2.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-03T00:00:00Z","modified":"2026-03-23T04:53:59.230099Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:20022-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\n- CVE-2025-59681: Fixed a potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB (boo#1250485)\n- CVE-2025-59682: Fixed a potential partial directory-traversal via archive.extract() (boo#1250487)\n","status":"published","published":"2025-10-31T08:58:03Z","modified":"2026-03-23T04:54:15.309741Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10005-1","title":"python312-Django6-6.0-1.1 on GA media","description":"These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-03T00:00:00Z","modified":"2026-03-23T04:54:19.792844Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11270-1","title":"python313-Django5-5.2.16-1.1 on GA media","description":"These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-14T00:00:00Z","modified":"2026-07-15T10:00:11.454078308Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"SUSE-SU-2025:03446-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\n- CVE-2025-59681: SQL injection via the `QuerySet` annotate()`, `alias()`, `aggregate()`, or `extra()` methods when\n  processing a specially crafted dictionary with dictionary expansion (bsc#1250485).\n- CVE-2025-59682: directory traversal via the `django.utils.archive.extract()` function when processing an archive with\n  file paths that share a common prefix with the target directory (bsc#1250487).\n","status":"published","published":"2025-10-02T07:13:00Z","modified":"2026-02-04T04:22:26.301208Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"USN-7794-1","title":"python-django vulnerabilities","description":"It was discovered that Django incorrectly handled special characters in the\nQuerySet function calls. A remote attacker could possibly use this issue to\nperform SQL injection attacks. (CVE-2025-59681)\n\nIt was discovered that Django incorrectly handled files with the same path\nprefix when starting with a template. An attacker could possibly use this\nissue to obtain sensitive information. (CVE-2025-59682)","status":"published","published":"2025-10-01T17:23:10Z","modified":"2026-06-25T13:32:31.133467131Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}