Skip to content
OpenAdvisories
High USN-4932-1 1 CVE

python-django vulnerability

Published May 4, 2021 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Django incorrectly handled certain
filenames. A remote attacker could possibly use this issue to create or
overwrite files in unexpected directories.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS python-django 1:1.11.11-1ubuntu1.13
Ubuntu · 20.04 LTS 20.04:LTS python-django 2:2.2.12-1ubuntu0.6

Vulnerabilities 1

  • High 7.5
    CVE-2021-31542

    Path Traversal in Django

    In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

    python-django django python-django Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2021-31542