Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
{ "ubuntu_priority": "low" }
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "python-django-common": "1:1.11.11-1ubuntu1.15", "python-django-doc": "1:1.11.11-1ubuntu1.15", "python-django": "1:1.11.11-1ubuntu1.15", "python3-django": "1:1.11.11-1ubuntu1.15" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "python-django-doc": "2:2.2.12-1ubuntu0.9", "python3-django": "2:2.2.12-1ubuntu0.9" } ] }