CVE-2025-59682Low· 3.1▾ SunlitAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 17.1 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.9%
3.1 → 8.8
low → high
Last analysed / modified upstream
8.8 → 3.1
high → low
0.9% → 0.9%
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.
django >= 4.2.0, < 4.2.25django >= 5.1, < 5.1.13django >= 5.2, < 5.2.7Upgrade past the affected range:
django 5.2.7Affected packages:
django >= 4.2, < 4.2.25django >= 5.1, < 5.1.13django >= 5.2, < 5.2.7Patched in:
django 4.2.25django 5.1.13django 5.2.7Source: https://osv.dev/vulnerability/GHSA-q95w-c7qg-hrff
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-1312Medium· 5.4An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, w…
CVE-2026-1287Medium· 5.4An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansio…
CVE-2026-1207Medium· 5.4An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupport…
CVE-2025-59681High· 7.1An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7
CVE-2026-87975Medium· 4.3An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of a primary key on a submitted form's instance as evidence tha…
CVE-2026-15307High· 8.8Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing