DEBIAN-CVE-2024-39330

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/DEBIAN-CVE-2024-39330

Import Source

https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-39330.json

JSON Data

https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2024-39330

Upstream

CVE-2024-39330

Published

2024-07-10T05:15:12Z

Modified

2025-09-19T06:14:20Z

Summary

[none]

Details

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)

References

https://security-tracker.debian.org/tracker/CVE-2024-39330

Affected packages

Debian:13 / python-django

Package

Name: python-django
Purl: pkg:deb/debian/python-django?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3:4.2.14-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:14 / python-django

Package

Name: python-django
Purl: pkg:deb/debian/python-django?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3:4.2.14-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}