low 3.1

CVE-2025-59682 json

Django vulnerable to partial directory traversal via archives

published 2025-10-01 13 mo ago modified 2026-10-12 27 d ago also BIT-django-2025-59682 , EUVD-2025-32692 , GHSA-q95w-c7qg-hrff , PYSEC-2026-1296

cvss: 3.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.9%; EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits: 0; none known

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.

Patch / fix

fixed in 3 distros 6 links 2

pypi django 4.2.25, 5.1.13, 5.2.7
bitnami django 4.2.25, 5.1.13, 5.2.7
djangoproject Django 4.2.25, 5.1.13, 5.2.7

debian ubuntu red hat suse opensuse alpine

python-django Debian 12 3:3.2.25-0+deb12u1
python-django Debian 13 3:4.2.27-0+deb13u1
python-django Debian 14 3:4.2.25-1

debian advisories DEBIAN-CVE-2025-59682

python-django Ubuntu 22.04 LTS 2:3.2.12-2ubuntu1.22
python-django Ubuntu 24.04 LTS 3:4.2.11-1ubuntu1.11
python-django Ubuntu 26.04 LTS, Ubuntu 25.10 3:5.2.4-1ubuntu2
python-django Ubuntu Pro 14.04 LTS 1.6.11-0ubuntu1.3+esm8
python-django Ubuntu Pro 16.04 LTS 1.8.7-1ubuntu5.15+esm9
python-django Ubuntu Pro 18.04 LTS 1:1.11.11-1ubuntu1.21+esm12
python-django Ubuntu Pro 20.04 LTS 2:2.2.12-1ubuntu0.29+esm4

ubuntu advisories UBUNTU-CVE-2025-59682

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

python3.11-django ansible automation platform developer 2.6, ansible automation platform developer 2.5, ansible automation platform 2.6 +1 more 4.2.25-1.el9ap
automation-platform-ui ansible automation platform 2.6 2.6.2-1.el9ap
automation-eda-controller ansible automation platform 2.6 1.2.1-1.el9ap
automation-eda-controller-base ansible automation platform 2.6 1.2.1-1.el9ap
automation-eda-controller-base-services ansible automation platform 2.6 1.2.1-1.el9ap
automation-eda-controller-worker-services ansible automation platform 2.6 1.2.1-1.el9ap
automation-eda-controller-event-stream-services ansible automation platform 2.6 1.2.1-1.el9ap
python3.11-django ansible automation platform developer 2.5, ansible automation platform 2.5 4.2.25-1.el8ap

red hat advisories RHSA-2025:19201 RHSA-2025:18979

python-Django SLE Module for Package Hub 15 SP7, SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 4.2.11-150600.3.33.1

suse advisories SUSE-SU-2025:03446-1

python-Django5 openSUSE Tumbleweed 5.2.16-1.1
python-Django6 openSUSE Tumbleweed 6.0-1.1
python-Django openSUSE Leap 16.0 5.2.4-bp160.3.1
python-Django openSUSE Tumbleweed 5.2.7-1.1
python-Django4 openSUSE Tumbleweed 4.2.25-1.1

opensuse advisories openSUSE-SU-2026:11270-1 openSUSE-SU-2026:10005-1 openSUSE-SU-2025:20022-1 openSUSE-SU-2025:15598-1 openSUSE-SU-2025:15596-1

py3-django Alpine 3.24, Alpine 3.23, Alpine 3.22 4.2.25-r0

alpine advisories ALPINE-CVE-2025-59682

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

github.com/django/django@43d84ae commit
github.com/django/django@924a0c0 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-59682 updated 2026-11-04 cvss 8.8

django: Potential partial directory-traversal via archive.extract()

Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-proxyv2-rhel9 Red Hat Ansible Automation Platform 2 python-django Red Hat Certification for Red Hat Enterprise Linux 7 python-django
affected: workaround, no fix available
Red Hat Satellite 6 python-django, python2-django, python-django-bash-completion
affected: workaround, no fix planned “Will not fix”
Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.11-django 4.2.25-1.el8ap, ansible-automation-platform-25/lightspeed-rhel8 2.5.250924-2 Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.11-django 4.2.25-1.el9ap
fixed: vendor fix RHSA-2025:18979
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26, ansible-automation-platform-tech-preview 2.6-1765600296
fixed: vendor fix RHSA-2025:19221
Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.11-django 4.2.25-1.el9ap
fixed: vendor fix RHSA-2025:19201
Red Hat Discovery 2 discovery 1767888970
fixed: vendor fix RHSA-2026:0414
Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-cni-rhel9, openshift-service-mesh/istio-pilot-rhel9, openshift-service-mesh/istio-rhel9-operator, openshift-service-mesh/istio-must-gather-rhel9, openshift-service-mesh/istio-sail-operator-bundle, openshift-service-mesh-tech-preview/istio-ztunnel-rhel9
not affected: component not present
Red Hat Ansible Automation Platform 2 automation-controller, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/ansible-dev-tools-rhel8 Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.0-2.1.el8ap, receptorctl 1.6.0-2.1.el8ap, automation-hub 4.10.9-1.el8ap, python3.11-galaxy-ng 4.10.9-1.el8ap, automation-controller 4.6.21-1.el8ap, automation-controller-ui 4.6.21-1.el8ap, +53 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.0-2.1.el9ap, receptorctl 1.6.0-2.1.el9ap, automation-hub 4.10.9-1.el9ap, python3.11-galaxy-ng 4.10.9-1.el9ap, automation-controller 4.6.21-1.el9ap, automation-gateway-proxy 2.6.6-4.el9ap, +29 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform, ansible-automation-platform-26 Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.0-2.1.el9ap, receptorctl 1.6.0-2.1.el9ap, ansible-builder 3.1.0-2.el9ap, automation-hub 4.11.2-1.el9ap, python3.11-daemon 3.1.2-1.el9ap, ansible-navigator 25.8.0-2.el9ap, +32 more Red Hat Discovery 1 discovery/discovery-server-rhel9

+1 more productsfewer

Red Hat Discovery 2 discovery 1767904573

not affected: vulnerable code not present

show 1 more

Red Hat OpenStack Platform 16.2 python-django20, python3-django20, python-django20-bash-completion Red Hat OpenStack Platform 17.1 python-django, python3-django Red Hat OpenStack Platform 18.0 python-django Red Hat Satellite 6 python-django, python2-django, python-django-bash-completion Red Hat Update Infrastructure 4 for Cloud Providers python-django
not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 13 mo ago (2025-10-01)

Exploit prediction

0.93% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	3.1	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
GitHub	3.1	3.1	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
OSV	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
OSV	3.1	3.1	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
pypi	django	>=4.2, <4.2.25 >=5.1, <5.1.13 >=5.2, <5.2.7	4.2.25 5.1.13 5.2.7
bitnami	django	>=4.2.0, <4.2.25 >=5.1.0, <5.1.13 >=5.2.0, <5.2.7	4.2.25 5.1.13 5.2.7

Affected products

djangoproject Django

Classification

Weakness

CWE-23 Relative Path Traversal

Technology feeds

Django rss critical rss

References

github.com /django/django/commit/43d84aef04a9e71164c21a74885996981857e66e
web
github.com /django/django/commit/924a0c092e65fa2d0953fd1855d2dc8786d94de2
web
docs.djangoproject.com /en/dev/releases/security/
vendor-advisory, advisory
groups.google.com /g/django-announce
web, release-notes, vendor-advisory, advisory
djangoproject.com /weblog/2025/oct/01/security-releases/
release-notes, vendor-advisory, advisory
openwall.com /lists/oss-security/2025/10/01/3
web
nvd.nist.gov /vuln/detail/CVE-2025-59682
advisory, web
docs.djangoproject.com /en/dev/releases/security
web
github.com /django/django
package
djangoproject.com /weblog/2025/oct/01/security-releases
web
pypi.org /project/django
package
github.com /advisories/GHSA-q95w-c7qg-hrff
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary