Django vulnerable to partial directory traversal via archives

🗓️ 01 Oct 2025 21:31:22Reported by GitHub Advisory DatabaseType

Django prior to 4.2.25, 5.1.13, and 5.2.7 is vulnerable to partial directory traversal in archive extraction for templates.

Reporter	Title	Published	Views	Family All 97
FreeBSD	Django -- multiple vulnerabilities	1 Oct 202500:00	–	freebsd
AlpineLinux	CVE-2025-59682	1 Oct 202500:00	–	alpinelinux
Chainguard	CVE-2025-59682 vulnerabilities	3 Oct 202513:45	–	cgr
Circl	CVE-2025-59682	1 Oct 202516:25	–	circl
CNNVD	Django 安全漏洞	1 Oct 202500:00	–	cnnvd
CVE	CVE-2025-59682	1 Oct 202500:00	–	cve
Cvelist	CVE-2025-59682	1 Oct 202500:00	–	cvelist
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses django-4.2.24-py3-none-any.whl which is vulnerable to CVE-2025-59681, CVE-2025-59682.	9 Dec 202514:05	–	ibm
IBM Security Bulletins	Security Bulletin: Allocation of resources without limits, heap-buffer-overread, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service	28 Oct 202516:41	–	ibm
Debian	[SECURITY] [DLA 4324-1] python-django security update	8 Oct 202517:19	–	debian

Vulners

Node

django_project djangoRange5.1–5.1.13pip

django_project djangoRange4.2–4.2.25pip

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-59682
docs	www.docs.djangoproject.com/en/dev/releases/security
groups	www.groups.google.com/g/django-announce
djangoproject	www.djangoproject.com/weblog/2025/oct/01/security-releases
github	www.github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e
github	www.github.com/django/django/commit/924a0c092e65fa2d0953fd1855d2dc8786d94de2
openwall	www.openwall.com/lists/oss-security/2025/10/01/3
github	www.github.com/advisories/GHSA-q95w-c7qg-hrff

05 Nov 2025 20:47Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.13.1 - 6.5

EPSS0.00018

SSVC