CVE-2021-33203: Path Traversal in Django
Summary
CVE-2021-33203: Path Traversal in Django. Affects django across 3 version ranges.
< 2.2.24
>= 3.0, < 3.1.12
>= 3.2, < 3.2.4
Fixed in 2.2.24, 3.1.12 or 3.2.4, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2021-33203 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework known for its simplicity and scalability. It provides a robust set of tools and features for building web applications. However, versions before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 are vulnerable to a path traversal vulnerability in the django.contrib.admindocs module. This vulnerability allows staff members to check the existence of arbitrary files and, in certain cases, expose their contents. The vulnerability arises from the TemplateDetailView view, which can be exploited by attackers to traverse directories outside of the template root directories.
Vulnerability Detail
The path traversal vulnerability in Django allows authenticated staff members to potentially access arbitrary files and, if the default admindocs templates have been customized to show file contents, expose their contents as well. By exploiting the TemplateDetailView view, an attacker can traverse directories outside of the template root directories. This could lead to unauthorized access to sensitive files and information, potentially compromising the security and integrity of the application.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.2.242.2.24pip install --upgrade "django==2.2.24" -
>= 3.0, < 3.1.123.1.12pip install --upgrade "django==3.1.12" -
>= 3.2, < 3.2.43.2.4pip install --upgrade "django==3.2.4"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround is to disable the admindocs module or restrict access to the affected views. By disabling or limiting access to the TemplateDetailView view, the path traversal vulnerability can be mitigated. However, this workaround may impact the functionality and features provided by the admindocs module.
Conclusion
The path traversal vulnerability in Django versions before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 can potentially allow authenticated staff members to access arbitrary files and expose their contents. It is crucial to upgrade to the recommended versions or apply the necessary patches to mitigate this vulnerability. Disabling or restricting access to the affected views can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows authenticated staff members to potentially access arbitrary files and, in certain cases, expose their contents. This could lead to unauthorized access to sensitive information and compromise the security of the application.
Applications using Django versions before 2.2.24, 3.x before 3.1.12, or 3.2.x before 3.2.4 are affected by this vulnerability. Specifically, staff members with access to the affected views are able to exploit the path traversal vulnerability.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to apply the necessary updates and patches to mitigate the risk.
No, this vulnerability requires authentication as a staff member to exploit. It cannot be exploited remotely without valid credentials.
Yes, the CVSS score for this vulnerability is 4.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
