CVE-2021-3281

—

CVSS 3.1

5.3 medium

EPSS

8%p94

Published

Feb 2, 2021 (Feb 2, 2021)

Modified

Jun 17, 2026

Description

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.

Vendors: djangoproject fedoraproject netapp
Products: django, fedora, snapcenter
Weakness: CWE-22
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (7.6%)

In the news0 stories

No ingested article mentions this CVE yet.