Skip to content
OpenAdvisories
Medium USN-4715-1 1 CVE

python-django vulnerability

Published Feb 1, 2021 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Wang Baohua discovered that Django incorrectly extracted archive files. A
remote attacker could possibly use this issue to extract files outside of
their expected location.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS python-django 1.8.7-1ubuntu5.14
Ubuntu · 18.04 LTS 18.04:LTS python-django 1:1.11.11-1ubuntu1.10
Ubuntu · 20.04 LTS 20.04:LTS python-django 2:2.2.12-1ubuntu0.3

Vulnerabilities 1

  • Medium 5.3
    CVE-2021-3281 Public exploit

    Django Directory Traversal via archive.extract

    In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with do…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2021-3281