Directory Traversal Vulnerability in Python-Django: CVE-2021-28658
Summary
UBUNTU-CVE-2021-28658: In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Affects python-django versions 1.5.4-1ubuntu1 – 1.6.11-0ubuntu1.3+esm7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, routing, and templating. However, certain versions of Python-Django are vulnerable to a directory traversal issue that can be exploited through crafted file names during file uploads.
Vulnerability Detail
In Django versions 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, the MultiPartParser component allowed attackers to perform directory traversal attacks via uploaded files with specially crafted file names. This vulnerability could lead to unauthorized access to sensitive files on the server, potentially compromising the integrity and confidentiality of the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is recommended to validate and sanitize file names before processing uploads to prevent directory traversal attacks. Implementing strict checks on the file paths can mitigate the risk until the package is updated.
Conclusion
The directory traversal vulnerability in Python-Django (CVE-2021-28658) poses a significant risk to applications using affected versions. It is crucial to update to the patched versions to safeguard against potential exploits. Regular monitoring and validation of file uploads can further enhance security.
See every vulnerability recorded for python-django →
FAQ
CVE-2021-28658 is a vulnerability in certain versions of Python-Django that allows directory traversal through crafted file names during file uploads.
The affected versions include Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8.
Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server, compromising the application's security.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for this vulnerability is 5.3, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
