GoogleOSV:GHSA-9JMF-237G-QF46Django Path Traversal vulnerability
AI Score
Confidence
Low
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)
References
docs.djangoproject.com/en/dev/releases/security
github.com/django/django
github.com/django/django/commit/2b00edc0151a660d1eb86da4059904a0fc4e095e
github.com/django/django/commit/9f4f63e9ebb7bf6cb9547ee4e2526b9b96703270
github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-58.yaml
groups.google.com/forum/#%21forum/django-announce
nvd.nist.gov/vuln/detail/CVE-2024-39330
www.djangoproject.com/weblog/2024/jul/09/security-releases
Related
