CVE-2021-33203: Directory Traversal Vulnerability in Django
Summary
CVE-2021-33203: Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Affects django across 3 version ranges.
< 2.2.24
>= 3.0, < 3.1.12
>= 3.2, < 3.2.4
Fixed in 2.2.24, 3.1.12 or 3.2.4, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2021-33203 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that simplifies the development of web applications. It provides a high-level, Pythonic interface for handling web requests and managing databases. Django includes a module called django.contrib.admindocs, which allows staff members to access documentation for the admin interface. This module includes a view called TemplateDetailView, which is used to display the contents of template files. However, versions of Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 are vulnerable to a directory traversal attack through django.contrib.admindocs. This vulnerability allows staff members to check the existence of arbitrary files outside of the template root directories. If the default admindocs templates have been customized to show file contents, the vulnerability also exposes the contents of these files.
Vulnerability Detail
The directory traversal vulnerability in Django's django.contrib.admindocs module allows staff members to access arbitrary files outside of the template root directories. This can lead to unauthorized access to sensitive information or the execution of malicious code. The vulnerability is present in Django versions before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4. The impact of this vulnerability depends on the specific configuration and customization of the admindocs templates. If the templates have been modified to display file contents, the vulnerability exposes not only the existence but also the contents of the files.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.2.242.2.24pip install --upgrade "django==2.2.24" -
>= 3.0, < 3.1.123.1.12pip install --upgrade "django==3.1.12" -
>= 3.2, < 3.2.43.2.4pip install --upgrade "django==3.2.4"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately possible, a temporary workaround is to disable the TemplateDetailView view in the django.contrib.admindocs module. This can be achieved by modifying the project's URL configuration to remove the route associated with the TemplateDetailView view. Here is an example of how to disable the view in a Django project's urls.py file:
from django.contrib.admindocs.views import TemplateDetailView
urlpatterns = [
# Other URL patterns
# ...
# Disable TemplateDetailView
# Comment out or remove the following line
# path('admin/docs/template/<path:template>/', TemplateDetailView.as_view(), name='django-admindocs-template-detail'),
# ...
]
Conclusion
In conclusion, the directory traversal vulnerability in Django's django.contrib.admindocs module allows staff members to access arbitrary files outside of the template root directories. This can lead to unauthorized access to sensitive information or the execution of malicious code. It is crucial to upgrade Django to the patched versions (2.2.24, 3.1.12, or 3.2.4) or apply the temporary workaround of disabling the TemplateDetailView view. For further assistance, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The impact of this vulnerability depends on the specific configuration and customization of the admindocs templates. If the templates have been modified to display file contents, the vulnerability exposes not only the existence but also the contents of the files. This can lead to unauthorized access to sensitive information or the execution of malicious code.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your Pipfile.lock to identify and alert you in real-time for open-source vulnerabilities in your software. No signup is required, and you can quickly assess the impact of this vulnerability on your Django application.
Yes, a temporary workaround is to disable the TemplateDetailView view in the django.contrib.admindocs module. This can be achieved by modifying the project's URL configuration to remove the route associated with the TemplateDetailView view. However, it is recommended to upgrade Django to the patched versions as soon as possible.
To fix this vulnerability, you should upgrade Django to version 2.2.24, 3.1.12, or 3.2.4, depending on the version currently in use. This can be done by updating the package using the package manager or by modifying the project's dependencies file (e.g., requirements.txt or Pipfile) and running the appropriate package installation command.
For further support on vulnerability remediation and assistance in securing your Django application, you can reach out to info@devnack.com. Our team of experts can provide guidance and help ensure the security of your application.
Related vulnerabilities
Recent vulnerabilities recorded for django.
