PT-2025-40291 · Django+4 · Django+4

Stackered · Publicado 2025-10-01 · Atualizado 2026-01-03 · CVE-2025-59682

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.24 Django versions 5.1 through 5.1.12 Django versions 5.2 through 5.2.6

Description The django.utils.archive.extract() function allows for potential directory traversal when handling archives with file paths that share a common prefix with the target directory. This issue affects the "startapp --template" and "startproject --template" commands.

Recommendations Update to Django version 4.2.25 or later. Update to Django version 5.1.13 or later. Update to Django version 5.2.7 or later.

Correção

Relative Path Traversal

Enumeração de Fraquezas

CWE-23

Identificadores relacionados

BDU:2025-12661

BIT-DJANGO-2025-59682

CVE-2025-59682

DLA-4324-1

ECHO-3ACC-85CC-F3E5

GHSA-Q95W-C7QG-HRFF

MGASA-2025-0243

OESA-2025-2378

OESA-2025-2379

OESA-2025-2460

OESA-2025-2461

OESA-2025-2462

OESA-2025-2463

OPENSUSE-SU-2025:15596-1

OPENSUSE-SU-2025:15598-1

OPENSUSE-SU-2025:20022-1

OPENSUSE-SU-2026:10005-1

SUSE-SU-2025:03446-1

USN-7794-1

Produtos afetados

Debian

Django

Linuxmint

Red Os

Ubuntu

Referências · 123

• https://github.com/django/django · Nota
• https://github.com/django/django/commit/924a0c092e65fa2d0953fd1855d2dc8786d94de2 · Nota
• https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e · Nota
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2461 · Nota
• https://docs.djangoproject.com/en/dev/releases/security · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-59682 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2025-59682 · Aviso do Fabricante
• https://osv.dev/vulnerability/DLA-4324-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2025-59681 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2021-31542 · Nota
• https://suse.com/security/cve/CVE-2021-35042 · Nota
• https://suse.com/security/cve/CVE-2024-41989 · Nota
• https://suse.com/security/cve/CVE-2024-42005 · Nota
• https://suse.com/security/cve/CVE-2025-59681 · Nota
• https://suse.com/security/cve/CVE-2024-56374 · Nota