https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T07:11:51.767436+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2021-3281 CVE-2021-3281 2026-10-04T07:11:51.799905+00:00

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

 https://cve.radiocsirt.org/vuln/ghsa-fvgf-6h6h-3322 GHSA-fvgf-6h6h-3322 — Django Directory Traversal via archive.extract 2026-10-04T07:11:51.799957+00:00

Affected: PyPI: Django

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.