CVE-2021-45452: Directory Traversal Vulnerability in Django
Summary
CVE-2021-45452: Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it. Affects django across 3 version ranges.
>= 2.2, < 2.2.26
>= 3.2, < 3.2.11
>= 4.0, < 4.0.1
Fixed in 2.2.26, 3.2.11 or 4.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- django · Bitnami
- python-django · Debian:11
The same CVE-2021-45452 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework known for its simplicity and scalability. It provides a comprehensive set of tools and libraries for building web applications. However, versions 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 of Django are susceptible to a directory traversal vulnerability in the Storage.save function. This vulnerability allows an attacker to perform unauthorized file access by exploiting crafted filenames passed directly to the function.
Vulnerability Detail
The directory traversal vulnerability in Django's Storage.save function arises from insufficient input validation. When filenames are not properly sanitized, an attacker can manipulate them to traverse directories and access sensitive files on the server. This can lead to unauthorized disclosure of sensitive information, modification of critical files, or even remote code execution. It is crucial to address this vulnerability promptly to prevent potential exploitation.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.2, < 2.2.262.2.26pip install --upgrade "django==2.2.26" -
>= 3.2, < 3.2.113.2.11pip install --upgrade "django==3.2.11" -
>= 4.0, < 4.0.14.0.1pip install --upgrade "django==4.0.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Django is not immediately feasible, a temporary workaround can be implemented by implementing additional input validation and sanitization measures. Before passing filenames to the Storage.save function, ensure that they only contain valid characters and do not include any directory traversal sequences (e.g., '../'). Additionally, consider implementing access controls and permissions to restrict file access and prevent unauthorized directory traversal.
Conclusion
The directory traversal vulnerability in Django versions 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 poses a significant risk to the security and integrity of web applications. It is crucial to upgrade Django to the recommended versions or implement temporary measures to mitigate the vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
The vulnerability allows attackers to access sensitive files on the server, potentially leading to unauthorized disclosure of information, file modification, or remote code execution.
Versions 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 of Django are affected by this vulnerability.
There are no known instances of this vulnerability being exploited in the wild at the time of this report. However, it is crucial to address it promptly to prevent potential exploitation.
Yes, upgrading Django to version 2.2.26, 3.2.11, or 4.0.1 includes the necessary patches to mitigate this vulnerability.
Yes, you can implement additional input validation and sanitization measures to prevent directory traversal. Ensure filenames only contain valid characters and do not include any directory traversal sequences. Implement access controls and permissions to restrict file access.
Related vulnerabilities
Recent vulnerabilities recorded for django.
