Directory Traversal Vulnerability in Python-Django: CVE-2021-45452
Summary
UBUNTU-CVE-2021-45452: Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it. Affects python-django versions 1.5.4-1ubuntu1 – 1.6.11-0ubuntu1.3+esm7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It provides a robust set of features for building web applications, including an ORM, URL routing, and templating. However, certain versions of Python-Django are vulnerable to a directory traversal issue, which can be exploited if crafted filenames are passed directly to the Storage.save method.
Vulnerability Detail
The vulnerability identified as CVE-2021-45452 affects Django versions prior to 2.2.26, 3.2 prior to 3.2.11, and 4.0 prior to 4.0.1. It allows attackers to perform directory traversal attacks by manipulating filenames, potentially leading to unauthorized access to sensitive files on the server. This issue arises from improper handling of file paths, which can be exploited to access files outside the intended directory structure.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid passing user-controlled filenames directly to the Storage.save method. Instead, validate and sanitize the filenames before processing them to prevent potential exploitation.
Conclusion
CVE-2021-45452 is a significant vulnerability in Python-Django that can lead to directory traversal attacks if not addressed. Users are strongly encouraged to update their Django installations to the latest patched versions to ensure the security of their applications.
See every vulnerability recorded for python-django →
FAQ
CVE-2021-45452 is a vulnerability in Python-Django that allows directory traversal through improper handling of filenames in the Storage.save method.
The vulnerability affects Django versions prior to 2.2.26, 3.2 prior to 3.2.11, and 4.0 prior to 4.0.1.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2021-45452 is 5.3, indicating a medium severity level.
If an immediate update is not possible, implement input validation and sanitization for filenames to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
