CVE-2021-31542: Path Traversal in Django
Summary
CVE-2021-31542: Path Traversal in Django. Affects django across 3 version ranges.
>= 2.2, < 2.2.21
>= 3.0, < 3.1.9
>= 3.2, < 3.2.1
Fixed in 2.2.21, 3.1.9 or 3.2.1, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2021-31542 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that provides a set of tools and libraries for building web applications. It is widely used for its simplicity, scalability, and security features. However, a vulnerability has been discovered in Django versions 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1. This vulnerability allows for path traversal attacks through uploaded files with specially crafted names.
Vulnerability Detail
The vulnerability arises from the improper handling of uploaded files by the MultiPartParser, UploadedFile, and FieldFile components in Django. Attackers can exploit this flaw by uploading files with manipulated names that include directory traversal sequences. As a result, they can bypass security measures and access files outside the intended directory. This can lead to unauthorized access, information disclosure, and potential remote code execution.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.2, < 2.2.212.2.21pip install --upgrade "django==2.2.21" -
>= 3.0, < 3.1.93.1.9pip install --upgrade "django==3.1.9" -
>= 3.2, < 3.2.13.2.1pip install --upgrade "django==3.2.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround can be implemented by validating and sanitizing file names during the upload process. This can be achieved by implementing a custom file name validation function that checks for and removes any directory traversal sequences or other potentially malicious characters. Here is an example of a Python code snippet that demonstrates this approach:
import os
def sanitize_filename(filename):
return os.path.basename(filename)
# Usage:
uploaded_file_name = 'path/to/../file.txt'
sanitized_name = sanitize_filename(uploaded_file_name)
print(sanitized_name) # Output: 'file.txt'
Conclusion
In conclusion, the path traversal vulnerability in Django versions 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1 can allow attackers to access files outside the intended directory. It is recommended to upgrade Django to the fixed versions or implement the provided workaround to mitigate the risk. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Django is a Python web framework that simplifies the development of web applications. It provides a high-level API and a set of tools for handling common web development tasks.
The vulnerability affects Django versions 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1. If you are using any of these versions, it is recommended to upgrade to the fixed versions.
Path traversal is a technique used by attackers to access files or directories outside the intended scope of an application. It involves manipulating file paths to bypass security measures and gain unauthorized access to sensitive files.
Exploiting this vulnerability can lead to unauthorized access to sensitive files, information disclosure, and potential remote code execution. Attackers can use the path traversal technique to navigate the file system and retrieve or modify files that should be protected.
At the time of this advisory, there are no known instances of this vulnerability being actively exploited. However, it is crucial to apply the necessary patches or upgrades to prevent potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for django.
