In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2021-02-02T06:16:28
Updated: 2024-08-03T16:53:17.221Z
Reserved: 2021-01-22T00:00:00
Link: CVE-2021-3281
Vulnrichment
No data.
NVD
Status : Modified
Published: 2021-02-02T07:15:14.020
Modified: 2024-11-21T06:21:12.677
Link: CVE-2021-3281
Redhat