CVE-2021-28658: Directory Traversal Vulnerability in Django
Summary
CVE-2021-28658: In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Affects django across 3 version ranges.
>= 2.2, < 2.2.20
>= 3.0, < 3.0.14
>= 3.1, < 3.1.8
Fixed in 2.2.20, 3.0.14 or 3.1.8, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2021-28658 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that simplifies the development of web applications. It provides a set of tools and libraries for handling various web-related tasks, such as URL routing, database management, and user authentication. Django is widely used in production environments and has a large community of developers contributing to its development and security. However, a directory traversal vulnerability has been discovered in versions 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8 of Django.
Vulnerability Detail
The vulnerability, identified as CVE-2021-28658, allows an attacker to perform directory traversal attacks by uploading files with specially crafted names. The MultiPartParser in Django fails to properly sanitize file names, enabling an attacker to traverse directories and potentially access sensitive files on the server. This vulnerability does not affect built-in upload handlers. Exploitation of this vulnerability could lead to unauthorized access to sensitive data or remote code execution.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.2, < 2.2.202.2.20pip install --upgrade "django==2.2.20" -
>= 3.0, < 3.0.143.0.14pip install --upgrade "django==3.0.14" -
>= 3.1, < 3.1.83.1.8pip install --upgrade "django==3.1.8"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the official patches by upgrading Django to the fixed versions.
Conclusion
The directory traversal vulnerability in Django can have serious security implications for web applications. It is crucial to upgrade to the fixed versions of Django (2.2.20, 3.0.14, or 3.1.8) to mitigate the risk of unauthorized access and potential remote code execution. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Django is a Python web framework that simplifies web application development by providing a set of tools and libraries.
Directory traversal is a technique used by attackers to access files and directories outside the intended scope of an application.
An attacker can exploit this vulnerability by uploading files with specially crafted names, allowing them to traverse directories and potentially access sensitive files on the server.
Exploitation of this vulnerability could lead to unauthorized access to sensitive data or remote code execution, depending on the attacker's intentions and the server's configuration.
No, built-in upload handlers in Django are not affected by this vulnerability. Only the MultiPartParser is vulnerable.
Related vulnerabilities
Recent vulnerabilities recorded for django.
