CVE-2025-59682: djangoproject django Relative Path Traversal
Vulnerability summary
CVE-2025-59682 is a medium (CVSS 6.5) Relative Path Traversal vulnerability in djangoproject django. EPSS estimates a 0.91% chance of exploitation in the next 30 days, higher than 59.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 13 · Related 9Timeline
- 01-10-2025PublishedVulnerability first disclosed.
- 04-11-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.
CVSS metrics
6 scores · 6 sources · 1 version- CVE.orgCNA3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:NDiffers
- OSV · PypiEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.91%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
0.00 pp
From 0.91% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard1 product
- awx< 24.6.1-r17
Debian1 product
- python-django< 3:3.2.25-0+deb12u1 | < 3:4.2.27-0+deb13u1 | < 3:4.2.25-1
Djangoproject1 product
- django≥ 4.2, < 4.2.25 | ≥ 4.2.0, < 4.2.25 | ≥ 5.1, < 5.1.13 | ≥ 5.2, < 5.2.7
PyPI1 product
- django≥ 4.2, < 4.2.25 | ≥ 5.1, < 5.1.13 | ≥ 5.2, < 5.2.7
Ubuntu1 product
- python-django< 1.6.11-0ubuntu1.3+esm8 | < 1.8.7-1ubuntu5.15+esm9 | < 1:1.11.11-1ubuntu1.21+esm12 | < 2:2.2.12-1ubuntu0.29+esm4 | < 2:3.2.12-2ubuntu1.22 | < 3:4.2.11-1ubuntu1.11 | < 3:5.2.4-1ubuntu2
5 vendors · 5 products
References
17 links
- github.com/django/djangoPACKAGE
Show all 17 references
- pypi.org/project/djangoPACKAGE
