CVE-2024-39330 — Path Traversal in Django
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 59.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJul 10
Latest updateJul 11
Description
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derived classes of the django.core.files.storage.Storage base class, when they override generate_filename() without replicating the file-path validations from the parent class, potentially allow directory traversal via certain inputs during a save() call. (Built-in Storage sub-classes are unaffected.)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4
Affected Packages2 packages
🔴Vulnerability Details
5📋Vendor Advisories
4Red Hat
▶
Debian▶
CVE-2024-39330: python-django - An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. Derive...↗2024