Medium USN-4902-1 1 CVE

python-django vulnerability

Published Apr 6, 2021 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Dennis Brinkrolf discovered that Django incorrectly handled certain
filenames. A remote attacker could possibly use this issue to create or
overwrite files in unexpected directories.

Fixed packages 3

Release	Package	Fixed in
Ubuntu · 16.04 LTS 16.04:LTS	python-django	1.8.7-1ubuntu5.15
Ubuntu · 18.04 LTS 18.04:LTS	python-django	1:1.11.11-1ubuntu1.12
Ubuntu · 20.04 LTS 20.04:LTS	python-django	2:2.2.12-1ubuntu0.5

Vulnerabilities 1

Medium 5.3

CVE-2021-28658

Directory Traversal in Django

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.

python-django django python-django py3-django Debian Ubuntu Alpine PyPI

Apr 6, 2021

References

report
https://ubuntu.com/security/CVE-2021-28658