Skip to content
Fencer Intel
low 3.1

CVE-2025-59682 json

Django vulnerable to partial directory traversal via archives

published last yr. modified 28d ago also BIT-django-2025-59682 , EUVD-2025-32692 , GHSA-q95w-c7qg-hrff , PYSEC-2026-1296

cvss
3.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 61%
public exploits
0
none known

Summary

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.

Patch / fix

  • pypi django 4.2.25, 5.1.13, 5.2.7
  • bitnami django 4.2.25, 5.1.13, 5.2.7
  • djangoproject Django 4.2.25, 5.1.13, 5.2.7
  • python-django Debian 12 3:3.2.25-0+deb12u1
  • python-django Debian 13 3:4.2.27-0+deb13u1
  • python-django Debian 14 3:4.2.25-1

debian advisories DEBIAN-CVE-2025-59682

  • python-django Ubuntu 22.04 LTS 2:3.2.12-2ubuntu1.22
  • python-django Ubuntu 24.04 LTS 3:4.2.11-1ubuntu1.11
  • python-django Ubuntu 26.04 LTS, Ubuntu 25.10 3:5.2.4-1ubuntu2
  • python-django Ubuntu Pro 14.04 LTS 1.6.11-0ubuntu1.3+esm8
  • python-django Ubuntu Pro 16.04 LTS 1.8.7-1ubuntu5.15+esm9
  • python-django Ubuntu Pro 18.04 LTS 1:1.11.11-1ubuntu1.21+esm12
  • python-django Ubuntu Pro 20.04 LTS 2:2.2.12-1ubuntu0.29+esm4

ubuntu advisories UBUNTU-CVE-2025-59682

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python3.11-django ansible automation platform developer 2.6, ansible automation platform developer 2.5, ansible automation platform 2.6 +1 more 4.2.25-1.el9ap
  • automation-platform-ui ansible automation platform 2.6 2.6.2-1.el9ap
  • automation-eda-controller ansible automation platform 2.6 1.2.1-1.el9ap
  • automation-eda-controller-base ansible automation platform 2.6 1.2.1-1.el9ap
  • automation-eda-controller-base-services ansible automation platform 2.6 1.2.1-1.el9ap
  • automation-eda-controller-worker-services ansible automation platform 2.6 1.2.1-1.el9ap
  • automation-eda-controller-event-stream-services ansible automation platform 2.6 1.2.1-1.el9ap
  • python3.11-django ansible automation platform developer 2.5, ansible automation platform 2.5 4.2.25-1.el8ap

red hat advisories RHSA-2025:19201RHSA-2025:18979

  • python-Django SLE Module for Package Hub 15 SP7, SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 4.2.11-150600.3.33.1

suse advisories SUSE-SU-2025:03446-1

  • python-Django5 openSUSE Tumbleweed 5.2.16-1.1
  • python-Django6 openSUSE Tumbleweed 6.0-1.1
  • python-Django openSUSE Leap 16.0 5.2.4-bp160.3.1
  • python-Django openSUSE Tumbleweed 5.2.7-1.1
  • python-Django4 openSUSE Tumbleweed 4.2.25-1.1

opensuse advisories openSUSE-SU-2026:11270-1openSUSE-SU-2026:10005-1openSUSE-SU-2025:20022-1openSUSE-SU-2025:15598-1openSUSE-SU-2025:15596-1

  • py3-django Alpine 3.24, Alpine 3.23, Alpine 3.22 4.2.25-r0

alpine advisories ALPINE-CVE-2025-59682

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2025-59682 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-59682 updated cvss 8.8

django: Potential partial directory-traversal via archive.extract()

  • Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-proxyv2-rhel9 Red Hat Ansible Automation Platform 2 python-django Red Hat Certification for Red Hat Enterprise Linux 7 python-django
    affected: workaround, no fix available
  • Red Hat Satellite 6 python-django, python2-django, python-django-bash-completion
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.11-django 4.2.25-1.el8ap, ansible-automation-platform-25/lightspeed-rhel8 2.5.250924-2 Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.11-django 4.2.25-1.el9ap
    fixed: vendor fix RHSA-2025:18979
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26, ansible-automation-platform-tech-preview 2.6-1765600296
    fixed: vendor fix RHSA-2025:19221
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.11-django 4.2.25-1.el9ap
    fixed: vendor fix RHSA-2025:19201
  • Red Hat Discovery 2 discovery 1767888970
    fixed: vendor fix RHSA-2026:0414
  • Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-cni-rhel9, openshift-service-mesh/istio-pilot-rhel9, openshift-service-mesh/istio-rhel9-operator, openshift-service-mesh/istio-must-gather-rhel9, openshift-service-mesh/istio-sail-operator-bundle, openshift-service-mesh-tech-preview/istio-ztunnel-rhel9
    not affected: component not present
  • Red Hat Ansible Automation Platform 2 automation-controller, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/ansible-dev-tools-rhel8 Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.0-2.1.el8ap, receptorctl 1.6.0-2.1.el8ap, automation-hub 4.10.9-1.el8ap, python3.11-galaxy-ng 4.10.9-1.el8ap, automation-controller 4.6.21-1.el8ap, automation-controller-ui 4.6.21-1.el8ap, +53 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.0-2.1.el9ap, receptorctl 1.6.0-2.1.el9ap, automation-hub 4.10.9-1.el9ap, python3.11-galaxy-ng 4.10.9-1.el9ap, automation-controller 4.6.21-1.el9ap, automation-gateway-proxy 2.6.6-4.el9ap, +29 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform, ansible-automation-platform-26 Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.0-2.1.el9ap, receptorctl 1.6.0-2.1.el9ap, ansible-builder 3.1.0-2.el9ap, automation-hub 4.11.2-1.el9ap, python3.11-daemon 3.1.2-1.el9ap, ansible-navigator 25.8.0-2.el9ap, +32 more Red Hat Discovery 1 discovery/discovery-server-rhel9
    +1 more products
    Red Hat Discovery 2 discovery 1767904573
    not affected: vulnerable code not present
show 1 more
  • Red Hat OpenStack Platform 16.2 python-django20, python3-django20, python-django20-bash-completion Red Hat OpenStack Platform 17.1 python-django, python3-django Red Hat OpenStack Platform 18.0 python-django Red Hat Satellite 6 python-django, python2-django, python-django-bash-completion Red Hat Update Infrastructure 4 for Cloud Providers python-django
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.97% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
GitHub 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
OSV 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
OSV 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
pypi django
>=4.2, <4.2.25
>=5.1, <5.1.13
>=5.2, <5.2.7
4.2.25
5.1.13
5.2.7
bitnami django
>=4.2.0, <4.2.25
>=5.1.0, <5.1.13
>=5.2.0, <5.2.7
4.2.25
5.1.13
5.2.7

Affected products

  • djangoproject Django

Classification

Weakness
  • CWE-23 Relative Path Traversal
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.