Vulnerability · Published Oct 1, 2025 · Assigned by mitre
CVE-2025-59682
Low 3.1
In plain English
A low-severity security flaw in Django from djangoproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | py3-django | 4.2.25-r0 | ALPINE-CVE-2025-59682 |
| Alpine:v3.23 | py3-django | 4.2.25-r0 | ALPINE-CVE-2025-59682 |
| Alpine:v3.24 | py3-django | 4.2.25-r0 | ALPINE-CVE-2025-59682 |
| Debian:12 | python-django | 3:3.2.25-0+deb12u1 | DSA-6136-1 |
| Debian:12 | python-django | 3:3.2.25-0+deb12u1 | DEBIAN-CVE-2025-59682 |
| Debian:13 | python-django | 3:4.2.27-0+deb13u1 | DSA-6117-1 |
| Debian:13 | python-django | 3:4.2.27-0+deb13u1 | DEBIAN-CVE-2025-59682 |
| Debian:14 | python-django | 3:4.2.25-1 | DEBIAN-CVE-2025-59682 |
| PyPI | django | 4.2.25, 5.1.13, 5.2.7 | PYSEC-2026-1296 |
| PyPI | django | 5.2.7 | GHSA-q95w-c7qg-hrff |
| PyPI | django | 5.1.13 | GHSA-q95w-c7qg-hrff |
| PyPI | django | 4.2.25 | GHSA-q95w-c7qg-hrff |
| Ubuntu:22.04:LTS | python-django | 2:3.2.12-2ubuntu1.22 | USN-7794-1 |
| Ubuntu:22.04:LTS | python-django | 2:3.2.12-2ubuntu1.22 | UBUNTU-CVE-2025-59682 |
| Ubuntu:24.04:LTS | python-django | 3:4.2.11-1ubuntu1.11 | UBUNTU-CVE-2025-59682 |
| Ubuntu:24.04:LTS | python-django | 3:4.2.11-1ubuntu1.11 | USN-7794-1 |
| Ubuntu:25.10 | python-django | 3:5.2.4-1ubuntu2 | UBUNTU-CVE-2025-59682 |
| Ubuntu:26.04:LTS | python-django | 3:5.2.4-1ubuntu2 | UBUNTU-CVE-2025-59682 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| djangoproject | Django | 4.2 – before 4.2.255.1 – before 5.1.135.2 – before 5.2.7 |
Weakness: CWE-23 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N