CVE-2025-59682: Django CVE-2025-59681 and CVE-2025-59682
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.
Other sources
The django.utils.archive.extract() function, used by startapp --template and startproject --template, allowed partial directory-traversal via an archive with file paths sharing a common prefix with the target directory.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59682?
CVE-2025-59682 is classified as a medium severity vulnerability due to its potential for partial directory traversal.
How do I fix CVE-2025-59682?
To fix CVE-2025-59682, update Django to version 4.2.25, 5.1.13, or 5.2.7 or later.
What versions of Django are affected by CVE-2025-59682?
Django versions 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7 are affected by CVE-2025-59682.
What functionality is impacted by CVE-2025-59682?
CVE-2025-59682 impacts the django.utils.archive.extract() function used in the 'startapp --template' and 'startproject --template' commands.
What type of attack does CVE-2025-59682 facilitate?
CVE-2025-59682 allows an attacker to achieve partial directory traversal through specially crafted archive files.