Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-n2v7-jqjy-37bc
Summary
Django vulnerable to partial directory traversal via archives
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.
Aliases
0
alias CVE-2025-59682
1
alias GHSA-q95w-c7qg-hrff
Fixed_packages
0
url pkg:pypi/django@4.2.25
purl pkg:pypi/django@4.2.25
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4kcg-gx5y-cuaw
1
vulnerability VCID-7c5n-nzwk-v7bz
2
vulnerability VCID-fcg9-xypn-ykhf
3
vulnerability VCID-ga69-9y5g-77c3
4
vulnerability VCID-ga7z-wj4j-63h1
5
vulnerability VCID-jybd-p65h-xffy
6
vulnerability VCID-kxdd-yzp3-r7cb
7
vulnerability VCID-phkp-9abp-f3dq
8
vulnerability VCID-r1vx-vv7d-gqaj
9
vulnerability VCID-shch-yusm-1uck
10
vulnerability VCID-shjc-2j68-2yfy
11
vulnerability VCID-tktt-vg92-6kae
12
vulnerability VCID-tuqc-c251-h7ds
13
vulnerability VCID-wa3g-27sx-mbcw
14
vulnerability VCID-whgc-pt2s-77ar
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2.25
1
url pkg:pypi/django@5.1.13
purl pkg:pypi/django@5.1.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-7c5n-nzwk-v7bz
1
vulnerability VCID-fcg9-xypn-ykhf
2
vulnerability VCID-ga69-9y5g-77c3
3
vulnerability VCID-whgc-pt2s-77ar
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.1.13
2
url pkg:pypi/django@5.2.7
purl pkg:pypi/django@5.2.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4kcg-gx5y-cuaw
1
vulnerability VCID-7c5n-nzwk-v7bz
2
vulnerability VCID-abpe-htm1-9ubp
3
vulnerability VCID-eqsc-axng-ckca
4
vulnerability VCID-fcg9-xypn-ykhf
5
vulnerability VCID-ga69-9y5g-77c3
6
vulnerability VCID-ga7z-wj4j-63h1
7
vulnerability VCID-jybd-p65h-xffy
8
vulnerability VCID-kxdd-yzp3-r7cb
9
vulnerability VCID-m4am-h2ea-3ffr
10
vulnerability VCID-phkp-9abp-f3dq
11
vulnerability VCID-r1vx-vv7d-gqaj
12
vulnerability VCID-shch-yusm-1uck
13
vulnerability VCID-shjc-2j68-2yfy
14
vulnerability VCID-tktt-vg92-6kae
15
vulnerability VCID-tuqc-c251-h7ds
16
vulnerability VCID-wa3g-27sx-mbcw
17
vulnerability VCID-whgc-pt2s-77ar
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2.7
Affected_packages
0
url pkg:pypi/django@4.2
purl pkg:pypi/django@4.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2ft7-rbey-kuhx
1
vulnerability VCID-4kcg-gx5y-cuaw
2
vulnerability VCID-5xtt-au84-zbb2
3
vulnerability VCID-7c5n-nzwk-v7bz
4
vulnerability VCID-7upw-5p86-8bfr
5
vulnerability VCID-9gq3-whr8-s7b8
6
vulnerability VCID-9kvc-1bdz-n3bd
7
vulnerability VCID-am3f-c5ex-8ff2
8
vulnerability VCID-bb8b-hq41-s7a6
9
vulnerability VCID-e12b-tw2c-53c9
10
vulnerability VCID-e8j6-mybr-17fh
11
vulnerability VCID-f4a7-tcz5-byfj
12
vulnerability VCID-fcg9-xypn-ykhf
13
vulnerability VCID-fsaw-3ta1-x3dw
14
vulnerability VCID-ga69-9y5g-77c3
15
vulnerability VCID-ga7z-wj4j-63h1
16
vulnerability VCID-hsjn-xnpp-5yeh
17
vulnerability VCID-jgv9-vdbm-sycd
18
vulnerability VCID-jybd-p65h-xffy
19
vulnerability VCID-kxdd-yzp3-r7cb
20
vulnerability VCID-m33h-4p9q-63fb
21
vulnerability VCID-n2v7-jqjy-37bc
22
vulnerability VCID-pa7y-gpwp-6qgj
23
vulnerability VCID-phkp-9abp-f3dq
24
vulnerability VCID-qgp1-4efd-6yg6
25
vulnerability VCID-qy1a-x3ff-4bc8
26
vulnerability VCID-r1vx-vv7d-gqaj
27
vulnerability VCID-rqqc-ta7c-ykgx
28
vulnerability VCID-s1rj-1xbw-fbg5
29
vulnerability VCID-shch-yusm-1uck
30
vulnerability VCID-shjc-2j68-2yfy
31
vulnerability VCID-tktt-vg92-6kae
32
vulnerability VCID-tuqc-c251-h7ds
33
vulnerability VCID-ud73-4t2c-n3at
34
vulnerability VCID-vgq9-s6th-yufg
35
vulnerability VCID-w777-44ns-cybg
36
vulnerability VCID-wa3g-27sx-mbcw
37
vulnerability VCID-whgc-pt2s-77ar
38
vulnerability VCID-xcmd-18ck-gqae
39
vulnerability VCID-ynt9-h6ww-h7e9
40
vulnerability VCID-yuda-1mur-8bbq
41
vulnerability VCID-z6tf-z1y9-cydq
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/django@4.2
1
url pkg:pypi/django@5.1
purl pkg:pypi/django@5.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2ft7-rbey-kuhx
1
vulnerability VCID-5xtt-au84-zbb2
2
vulnerability VCID-7c5n-nzwk-v7bz
3
vulnerability VCID-9kvc-1bdz-n3bd
4
vulnerability VCID-bb8b-hq41-s7a6
5
vulnerability VCID-fcg9-xypn-ykhf
6
vulnerability VCID-ga69-9y5g-77c3
7
vulnerability VCID-hsjn-xnpp-5yeh
8
vulnerability VCID-n2v7-jqjy-37bc
9
vulnerability VCID-pa7y-gpwp-6qgj
10
vulnerability VCID-qw15-2kq7-wqed
11
vulnerability VCID-qy1a-x3ff-4bc8
12
vulnerability VCID-ud73-4t2c-n3at
13
vulnerability VCID-whgc-pt2s-77ar
14
vulnerability VCID-ynt9-h6ww-h7e9
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.1
2
url pkg:pypi/django@5.2
purl pkg:pypi/django@5.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-4kcg-gx5y-cuaw
1
vulnerability VCID-5xtt-au84-zbb2
2
vulnerability VCID-7c5n-nzwk-v7bz
3
vulnerability VCID-7upw-5p86-8bfr
4
vulnerability VCID-9kvc-1bdz-n3bd
5
vulnerability VCID-abpe-htm1-9ubp
6
vulnerability VCID-bb8b-hq41-s7a6
7
vulnerability VCID-eqsc-axng-ckca
8
vulnerability VCID-fcg9-xypn-ykhf
9
vulnerability VCID-ga69-9y5g-77c3
10
vulnerability VCID-ga7z-wj4j-63h1
11
vulnerability VCID-jybd-p65h-xffy
12
vulnerability VCID-kxdd-yzp3-r7cb
13
vulnerability VCID-m4am-h2ea-3ffr
14
vulnerability VCID-n2v7-jqjy-37bc
15
vulnerability VCID-phkp-9abp-f3dq
16
vulnerability VCID-r1vx-vv7d-gqaj
17
vulnerability VCID-shch-yusm-1uck
18
vulnerability VCID-shjc-2j68-2yfy
19
vulnerability VCID-tktt-vg92-6kae
20
vulnerability VCID-tuqc-c251-h7ds
21
vulnerability VCID-w777-44ns-cybg
22
vulnerability VCID-wa3g-27sx-mbcw
23
vulnerability VCID-whgc-pt2s-77ar
24
vulnerability VCID-ynt9-h6ww-h7e9
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/django@5.2
References
0
reference_url https://docs.djangoproject.com/en/dev/releases/security
reference_id
reference_type
scores
url https://docs.djangoproject.com/en/dev/releases/security
1
reference_url https://github.com/django/django
reference_id
reference_type
scores
url https://github.com/django/django
2
reference_url https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e
reference_id
reference_type
scores
url https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e
3
reference_url https://github.com/django/django/commit/924a0c092e65fa2d0953fd1855d2dc8786d94de2
reference_id
reference_type
scores
url https://github.com/django/django/commit/924a0c092e65fa2d0953fd1855d2dc8786d94de2
4
reference_url https://groups.google.com/g/django-announce
reference_id
reference_type
scores
url https://groups.google.com/g/django-announce
5
reference_url https://www.djangoproject.com/weblog/2025/oct/01/security-releases
reference_id
reference_type
scores
url https://www.djangoproject.com/weblog/2025/oct/01/security-releases
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-59682
reference_id CVE-2025-59682
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2025-59682
7
reference_url https://github.com/advisories/GHSA-q95w-c7qg-hrff
reference_id GHSA-q95w-c7qg-hrff
reference_type
scores
url https://github.com/advisories/GHSA-q95w-c7qg-hrff
Weaknesses
0
cwe_id 23
name Relative Path Traversal
description The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.
1
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_scorenull
Exploitabilitynull
Weighted_severitynull
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-n2v7-jqjy-37bc