CVE-2025-59682

NameCVE-2025-59682
DescriptionAn issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1116979

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-django (PTS)bullseye2:2.2.28-1~deb11u2vulnerable
bullseye (security)2:2.2.28-1~deb11u8vulnerable
bookworm, bookworm (security)3:3.2.19-1+deb12u1vulnerable
trixie3:4.2.23-1vulnerable
forky3:4.2.24-1vulnerable
sid3:4.2.25-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-djangosource(unstable)3:4.2.25-11116979

Notes

https://www.djangoproject.com/weblog/2025/oct/01/security-releases/
https://github.com/django/django/commit/9504bbaa392c9fe37eee9291f5b4c29eb6037619 (4.2.25)

Search for package or bug name: Reporting problems