python-django: Potential directory-traversal in django.core.files.storage.Storage.save()

🗓️ 05 Sep 2024 14:13:20Reported by RedHatType

Django vulnerability: derived storage classes overriding generate_filename bypass path checks, enabling directory traversal on save.

Reporter	Title	Published	Views	Family All 110
FreeBSD	Django -- multiple vulnerabilities	1 Jul 202400:00	–	freebsd
AlpineLinux	CVE-2024-39330	10 Jul 202400:00	–	alpinelinux
AstraLinux	Astra Linux – Vulnerability in Python-Django	20 May 202605:53	–	astralinux
BDU FSTEC	The vulnerability of the generate_filename() function in the django.core.files.storage.Storage class of the Django web application framework allows a malicious actor to write arbitrary files.	18 Sep 202400:00	–	bdu_fstec
IBM Security Bulletins	Security Bulletin: Denial of service and remote code execution might affect IBM Storage Defender – Resiliency Service	30 Jul 202418:43	–	ibm
IBM Security Bulletins	Security Bulletin: Denial of service, directory traversal, and other vulnerabilities might affect IBM Storage Defender – Resiliency Service	15 Apr 202502:50	–	ibm
Chainguard	CVE-2024-39330 vulnerabilities	10 Jul 202405:15	–	cgr
Circl	CVE-2024-39330	10 Jul 202407:33	–	circl
CNNVD	Django Security Vulnerabilities	10 Jul 202400:00	–	cnnvd
CVE	CVE-2024-39330	10 Jul 202400:00	–	cve

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	9	noarch	python3-django	4.2.15-1.el9ap	python3-django-4.2.15-1.el9ap.noarch.rpm
Red Hat Enterprise Linux	8	noarch	python39-django	4.2.15-1.el8ap	python39-django-4.2.15-1.el8ap.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2024-39330
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-39330
cve	www.cve.org/CVERecord

19 Jul 2026 00:42Current

7High risk

Vulners AI Score7

CVSS 3.14.3

EPSS0.01

SSVC