CNNVD-202510-024 Information
CNNVD ID
CNNVD-202510-024
Related CVE
- CNNVD Published: 2025-10-01
Description (Chinese)
Django是Django基金会的一套基于Python语言的开源Web应用框架。该框架包括面向对象的映射器、视图系统、模板系统等。 Django 4.2版本至4.2.25之前版本、5.1版本至5.1.13之前版本和5.2版本至5.2.7之前版本存在安全漏洞，该漏洞源于django.utils.archive.extract函数允许部分目录遍历，可能导致路径遍历攻击。
Description (English)
Django is an open-source Web application framework based on the Python language of the Django Foundation. The framework includes object-oriented maprs, view systems, templates, etc. The pre-Django 4.2 to 4.2.25, pre-Version 5.1 to 5.1.13 and pre-Version 5.2 to 5.2.7 have a security loophole, which originates from the django.utils.archive.extract functions that allow parts of the catalogue to go through, which may lead to a routing attack.
Hazard Level
Critical
Vulnerability Type
其他
Affected Vendor
Django
Published
2025-10-01
Last Modified
2026-02-24
References
https://docs.djangoproject.com/en/dev/releases/security/ https://groups.google.com/g/django-announce https://www.djangoproject.com/weblog/2025/oct/01/security-releases/ https://vigilance.fr/vulnerability/Django-directory-traversal-via-archive-extract-48371
Patch
https://www.djangoproject.com/
Share on: