Skip to content
OpenAdvisories
Medium USN-4715-2 1 CVE

python-django vulnerability

Published Feb 1, 2021 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

USN-4715-1 fixed a vulnerability in Django. This update provides
the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

Wang Baohua discovered that Django incorrectly extracted archive files. A
remote attacker could possibly use this issue to extract files outside of
their expected location.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS python-django 1.6.11-0ubuntu1.3+esm2

Vulnerabilities 1

  • Medium 5.3
    CVE-2021-3281 Public exploit

    Django Directory Traversal via archive.extract

    In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with do…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2021-3281