CVE-2021-3281: Improper Limitation of a Pathname to a Restricted Directory in Django
Summary
CVE-2021-3281: Improper Limitation of a Pathname to a Restricted Directory. Affects django across 3 version ranges.
>= 2.2, < 2.2.18
>= 3.0, < 3.0.12
>= 3.1, < 3.1.6
Fixed in 2.2.18, 3.0.12 or 3.1.6, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2021-3281 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that provides a set of tools and libraries for building web applications. It offers features such as URL routing, template engine, database management, and more. However, Django versions 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6 are vulnerable to an improper limitation of a pathname to a restricted directory. This vulnerability affects the 'django.utils.archive.extract' method, which is used by the 'startapp --template' and 'startproject --template' commands. Attackers can exploit this vulnerability to perform directory traversal attacks by using an archive with absolute paths or relative paths with dot segments.
Vulnerability Detail
The vulnerability in Django allows attackers to bypass directory restrictions and access files outside of the intended directory. This can lead to unauthorized access, information disclosure, and potential remote code execution. The issue arises from the improper handling of paths in the 'django.utils.archive.extract' method. By manipulating the paths in the archive, an attacker can traverse directories and access sensitive files on the system. This vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.2, < 2.2.182.2.18pip install --upgrade "django==2.2.18" -
>= 3.0, < 3.0.123.0.12pip install --upgrade "django==3.0.12" -
>= 3.1, < 3.1.63.1.6pip install --upgrade "django==3.1.6"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately possible, a temporary workaround is to avoid using the 'startapp --template' and 'startproject --template' commands. Instead, developers can manually create the app or project structure without using templates. This eliminates the risk of directory traversal through the vulnerable method.
Conclusion
The vulnerability in Django versions 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6 allows for directory traversal attacks, potentially leading to unauthorized access and information disclosure. It is crucial to upgrade to the fixed versions or apply the provided workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows attackers to access files outside of the intended directory, potentially leading to unauthorized access, information disclosure, and remote code execution.
You can use the Vulert Playground at Vulert Scanner to check if your Django installation is affected by this vulnerability. It analyzes your Pipfile.lock and provides real-time alerts for open-source vulnerabilities.
No, only Django versions 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6 are affected. It is recommended to upgrade to the fixed versions to mitigate the vulnerability.
While there is no known public exploit at the moment, it is crucial to patch the vulnerability as soon as possible to prevent potential attacks.
In addition to upgrading Django to the fixed versions, it is recommended to follow secure coding practices, validate user input, and implement proper access controls to mitigate the risk of directory traversal attacks.
Related vulnerabilities
Recent vulnerabilities recorded for django.
