CVE-2025-59682

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.

References

Affected packages

Git / github.com/django/django

Affected ranges

Type

GIT

Repo

https://github.com/django/django

Events

Introduced

Fixed

57d20b2485e7cd2f029dbf49fb5510b2a6f12c48

Introduced

84d09a547fe35e10018ab242602ca76c29ca91a1

Fixed

467aeeb569da17a7573e8dfc4932434c84e70642

Introduced

9e7cc2b628fe8fd3895986af9b7fc9525034c1b0

Fixed

3cff3209e35a560f94801d428cf7f2a3ecb2a051

Database specific

{
    "versions": [
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "4.2.25"
        },
        {
            "introduced": "5.1"
        },
        {
            "fixed": "5.1.13"
        },
        {
            "introduced": "5.2"
        },
        {
            "fixed": "5.2.7"
        }
    ]
}

Affected versions

5.*

5.2

5.2.1

5.2.2

5.2.3

5.2.4

5.2.5

5.2.6

stable/5.*

stable/5.1.x

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-59682.json"