Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on…
Priority LOW 38CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.
Summary
Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.
Why it matters now
EPSS 0.02856 86th percentileScored 2026-11-07
Fix Fixed Django (PyPI): 1.1.4, 1.2.5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | Django (PyPI) | 1.1 to before 1.1.4 | 1.1.4 | Patch available | GHSA-7g9h-c88w-r7h2 |
| — | Django (PyPI) | 1.2 to before 1.2.5 | 1.2.5 | Patch available | GHSA-7g9h-c88w-r7h2 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- Django (PyPI) Vendor— Affected 1.1 to before 1.1.4 Fixed in 1.1.4 Patch available GHSA-7g9h-c88w-r7h2
- Django (PyPI) Vendor— Affected 1.2 to before 1.2.5 Fixed in 1.2.5 Patch available GHSA-7g9h-c88w-r7h2
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:djangoproject:django:1.1:*:*:*:*:*:*:* | 1.1 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.1.0:*:*:*:*:*:*:* | 1.1.0 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.1.2:*:*:*:*:*:*:* | 1.1.2 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.1.3:*:*:*:*:*:*:* | 1.1.3 | Vulnerable | djangoproject |
| cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:* | all versions | Running on | Microsoft |
| cpe:2.3:a:djangoproject:django:1.2:*:*:*:*:*:*:* | 1.2 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.2.1:*:*:*:*:*:*:* | 1.2.1 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.2.2:*:*:*:*:*:*:* | 1.2.2 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.2.3:*:*:*:*:*:*:* | 1.2.3 | Vulnerable | djangoproject |
| cpe:2.3:a:djangoproject:django:1.2.4:*:*:*:*:*:*:* | 1.2.4 | Vulnerable | djangoproject |
- cpe:2.3:a:djangoproject:django:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.1.3:*:*:*:*:*:*:* Versions 1.1.3 Vulnerable ·djangoproject
- cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
- cpe:2.3:a:djangoproject:django:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.2.3:*:*:*:*:*:*:* Versions 1.2.3 Vulnerable ·djangoproject
- cpe:2.3:a:djangoproject:django:1.2.4:*:*:*:*:*:*:* Versions 1.2.4 Vulnerable ·djangoproject
Remediation
- Fix · GHSA-7g9h-c88w-r7h2 Django (PyPI) Fixed in 1.1.4 Advisory →
- Fix · GHSA-7g9h-c88w-r7h2 Django (PyPI) Fixed in 1.2.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2011-0698
- 2026-10-03 Alias added: GHSA-7g9h-c88w-r7h2
References
Patch 2
Advisory 3
Other 9
- ADV-2011-0439
- ADV-2011-0372
- https://github.com/django/django/commit/194566480b15cf4e294d3f03ff587019b74044b2
- https://github.com/django/django/commit/570a32a047ea56265646217264b0d3dab1a14dbd
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2011-12.yaml
- https://web.archive.org/web/20110521033259/http://secunia.com/advisories/43230
- https://web.archive.org/web/20130616104703/http://www.securityfocus.com/bid/46296
- http://www.djangoproject.com/weblog/2011/feb/08/security
More djangoproject Django vulnerabilities
- TI-2022-15177 An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. CVSS 3.1CRITICAL 9.8
- TI-2020-05994 Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection… CVSS 3.1CRITICAL 9.8
- TI-2023-10198 An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0… CVSS 3.1HIGH 7.5
- TI-2019-14306 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. CVSS 3.1CRITICAL 9.8
- TI-2019-10595 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x… CVSS 3.0CRITICAL 9.8
- TI-2021-14006 Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2011-0698 · CVE Program
- CVE-2011-0698 · NVD
- FIRST EPSS
- GHSA-7g9h-c88w-r7h2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences