---
id: CVE-2025-59682
title: >-
  An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and
  5.2 before 5.2.7
summary: >-
  An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and
  5.2 before 5.2.7. The django.utils.archive.extract() function, used by the
  "startapp --template" and "startproject --template" commands, allows partial
  directory…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-23
  - CWE-22
vendor: djangoproject
product: django
affected:
  - 'django >= 4.2.0, < 4.2.25'
  - 'django >= 5.1, < 5.1.13'
  - 'django >= 5.2, < 5.2.7'
patched:
  - django 5.2.7
published: '2025-10-01'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:10:00.207'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59682'
references:
  - url: 'https://docs.djangoproject.com/en/dev/releases/security/'
    label: cve@mitre.org
  - url: 'https://groups.google.com/g/django-announce'
    label: cve@mitre.org
  - url: 'https://www.djangoproject.com/weblog/2025/oct/01/security-releases/'
    label: cve@mitre.org
  - url: 'http://www.openwall.com/lists/oss-security/2025/10/01/3'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59682.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-59682'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2400450'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-59682'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59682'
  - url: 'https://access.redhat.com/errata/RHSA-2025:18979'
  - url: 'https://access.redhat.com/errata/RHSA-2025:18984'
  - url: 'https://access.redhat.com/errata/RHSA-2025:19201'
  - url: 'https://access.redhat.com/errata/RHSA-2025:19221'
  - url: 'https://access.redhat.com/errata/RHSA-2025:23196'
  - url: 'https://access.redhat.com/errata/RHSA-2026:0414'
  - url: >-
      https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e
  - url: >-
      https://github.com/django/django/commit/924a0c092e65fa2d0953fd1855d2dc8786d94de2
  - url: 'https://docs.djangoproject.com/en/dev/releases/security'
  - url: 'https://github.com/django/django'
  - url: 'https://www.djangoproject.com/weblog/2025/oct/01/security-releases'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - osv
  - pip
  - score-dispute
epss: 0.00932
epssPercentile: 0.60514
aliases:
  - GHSA-q95w-c7qg-hrff
  - BIT-django-2025-59682
  - PYSEC-2026-1296
ecosystem: pip
scores:
  nvd: 3.1
  vendor: 8.8
  osv: 3.1
ingestedAt: '2026-07-08T18:25:52.347Z'
---

## Overview

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.

## Affected

- `django >= 4.2.0, < 4.2.25`
- `django >= 5.1, < 5.1.13`
- `django >= 5.2, < 5.2.7`

## Remediation

Upgrade past the affected range:

- `django 5.2.7`

## Package advisory (CVE-2025-59682)

Affected packages:

- `django >= 4.2, < 4.2.25`
- `django >= 5.1, < 5.1.13`
- `django >= 5.2, < 5.2.7`

Patched in:

- `django 4.2.25`
- `django 5.1.13`
- `django 5.2.7`

Source: https://osv.dev/vulnerability/GHSA-q95w-c7qg-hrff

## Vendor advisories

- **RHSA-2025:18979** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2025-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2025:18979)
- **RHSA-2025:18984** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8 · released 2025-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2025:18984)
- **RHSA-2025:19201** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2025-10-28 · [advisory](https://access.redhat.com/errata/RHSA-2025:19201)
- **RHSA-2025:19221** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2025-10-28 · [advisory](https://access.redhat.com/errata/RHSA-2025:19221)
- **RHSA-2025:23196** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2025-12-15 · [advisory](https://access.redhat.com/errata/RHSA-2025:23196)
- **RHSA-2026:0414** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-01-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:0414)
- **Red Hat VEX** · Important · affected: OpenShift Service Mesh 3, Red Hat Ansible Automation Platform 2, Red Hat Certification for Red Hat Enterprise Linux 7, Red Hat Satellite 6 · no fix planned: Red Hat Satellite 6, OpenShift Service Mesh 3, Red Hat Ansible Automation Platform 2, Red Hat Certification for Red Hat Enterprise Linux 7 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59682.json)