CVE-2025-59682lowCWE-23

CVE-2025-59682

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 3.1epss 0.9%

probabilidad de explotación

0.9%top 46% de las CVE

explotación observada

noninguna fuente lo reporta

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Productos afectados

djangoproject · Django

Referencias

https://docs.djangoproject.com/en/dev/releases/security/https://groups.google.com/g/django-announce https://www.djangoproject.com/weblog/2025/oct/01/security-releases/http://www.openwall.com/lists/oss-security/2025/10/01/3