Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:alpm/archlinux/python-django@4.0.6-1
purl pkg:alpm/archlinux/python-django@4.0.6-1
Next non-vulnerable version 4.0.7-1
Latest non-vulnerable version 5.1.11-1
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-6gss-ppm5-3yc9
Aliases:
BIT-django-2022-36359
CVE-2022-36359
GHSA-8x94-hmjh-97hq
PYSEC-2022-245
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.
4.0.7-1
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-t6uc-dfrd-jyfg An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected. BIT-django-2022-34265
CVE-2022-34265
GHSA-p64x-8rxx-wf6q
PYSEC-2022-213

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T18:25:09.410844+00:00 Arch Linux Importer Fixing VCID-t6uc-dfrd-jyfg https://security.archlinux.org/AVG-2788 38.0.0
2026-04-01T18:24:08.911595+00:00 Arch Linux Importer Affected by VCID-6gss-ppm5-3yc9 https://security.archlinux.org/AVG-2810 38.0.0