Directory Traversal Vulnerability in Python-Django Package
Summary
UBUNTU-CVE-2025-59682: Potential partial directory-traversal via archive.extract(). Affects python-django versions < 1.6.11-0ubuntu1.3+esm8. Fixed in 1.6.11-0ubuntu1.3+esm8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features including an ORM, routing, and templating. However, certain versions of Python-Django have been found to be vulnerable to a partial directory traversal issue, which could potentially allow unauthorized access to sensitive files.
Vulnerability Detail
The vulnerability, identified as CVE-2025-59682, arises from a flaw in the archive.extract() method, which may allow an attacker to exploit the application by manipulating file paths. This could lead to unauthorized access to files outside the intended directory structure, posing a risk to the integrity and confidentiality of the system. The CVSS score for this vulnerability is 3.1, indicating a medium severity level.
How To Fix
Minimum fixed version
1.6.11-0ubuntu1.3+esm8
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, ensure that user input is properly sanitized and validated before being processed by the archive.extract() method. This can help mitigate the risk of directory traversal attacks until the package is updated.
Conclusion
The directory traversal vulnerability in the Python-Django package poses a significant risk to applications using affected versions. It is crucial to update to the patched versions provided for various Ubuntu distributions to mitigate this risk. Additionally, implementing proper input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for python-django →
FAQ
CVE-2025-59682 is a vulnerability in the Python-Django package that allows for potential partial directory traversal via the archive.extract() method.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server, compromising the security of the application.
Yes, patched versions of the Python-Django package are available for various Ubuntu distributions. It is recommended to update to the latest version.
The CVSS score for this vulnerability is 3.1, indicating a medium severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
