Skip to content
OpenAdvisories
High USN-4932-2 1 CVE

python-django vulnerability

Published May 13, 2021 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

USN-4932-1 fixed a vulnerability in Django. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that Django incorrectly handled certain
filenames. A remote attacker could possibly use this issue to create or
overwrite files in unexpected directories.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS python-django 1.6.11-0ubuntu1.3+esm3
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS python-django 1.8.7-1ubuntu5.15+esm1

Vulnerabilities 1

  • High 7.5
    CVE-2021-31542

    Path Traversal in Django

    In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

    python-django django python-django Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2021-31542