CVE-2025-59682

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.

References

Affected packages

Git / github.com/django/django

Affected ranges

Type

GIT

Repo

https://github.com/django/django

Events

Introduced

Fixed

57d20b2485e7cd2f029dbf49fb5510b2a6f12c48

Introduced

84d09a547fe35e10018ab242602ca76c29ca91a1

Fixed

467aeeb569da17a7573e8dfc4932434c84e70642

Introduced

9e7cc2b628fe8fd3895986af9b7fc9525034c1b0

Fixed

3cff3209e35a560f94801d428cf7f2a3ecb2a051

Database specific

{
    "versions": [
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "4.2.25"
        },
        {
            "introduced": "5.1"
        },
        {
            "fixed": "5.1.13"
        },
        {
            "introduced": "5.2"
        },
        {
            "fixed": "5.2.7"
        }
    ]
}

Affected versions

1.*

1.0

1.1

1.2

1.2.1

1.3

1.4

1.7a2

4.*

4.2

4.2.1

4.2.10

4.2.11

4.2.12

4.2.13

4.2.14

4.2.15

4.2.16

4.2.17

4.2.18

4.2.19

4.2.2

4.2.20

4.2.21

4.2.22

4.2.23

4.2.24

4.2.3

4.2.4

4.2.5

4.2.6

4.2.7

4.2.8

4.2.9

4.2a1

4.2b1

4.2rc1

5.*

5.1

5.1.1

5.1.10

5.1.11

5.1.12

5.1.2

5.1.3

5.1.4

5.1.5

5.1.6

5.1.7

5.1.8

5.1.9

5.1a1

5.1b1

5.1rc1

5.2

5.2.1

5.2.2

5.2.3

5.2.4

5.2.5

5.2.6

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-59682.json"