In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the…
Priority LOW 34CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 5 fixed, 8 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.
Why it matters now
EPSS 0.07605 94th percentileScored 2026-11-07
Fix Partial Django (PyPI): 2.2.18, 3.1.6, 3.0.12Red Hat: 4 advisoriesRed Hat: 5 fixed, 8 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | Django (PyPI) | 2.2 to before 2.2.18 | 2.2.18 | Patch available | GHSA-fvgf-6h6h-3322 |
| — | Django (PyPI) | 3.1 to before 3.1.6 | 3.1.6 | Patch available | GHSA-fvgf-6h6h-3322 |
| — | Django (PyPI) | 3.0 to before 3.0.12 | 3.0.12 | Patch available | GHSA-fvgf-6h6h-3322 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- Django (PyPI) Vendor— Affected 2.2 to before 2.2.18 Fixed in 2.2.18 Patch available GHSA-fvgf-6h6h-3322
- Django (PyPI) Vendor— Affected 3.1 to before 3.1.6 Fixed in 3.1.6 Patch available GHSA-fvgf-6h6h-3322
- Django (PyPI) Vendor— Affected 3.0 to before 3.0.12 Fixed in 3.0.12 Patch available GHSA-fvgf-6h6h-3322
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* | 2.2 to before 2.2.18; 3.0 to before 3.0.12; 3.1 to before 3.1.6 | Vulnerable | djangoproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions 2.2 to before 2.2.18; 3.0 to before 3.0.12; 3.1 to before 3.1.6 Vulnerable ·djangoproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-fvgf-6h6h-3322 Django (PyPI) Fixed in 2.2.18 Advisory →
- Fix · GHSA-fvgf-6h6h-3322 Django (PyPI) Fixed in 3.1.6 Advisory →
- Fix · GHSA-fvgf-6h6h-3322 Django (PyPI) Fixed in 3.0.12 Advisory →
Red Hat 4 advisories
- RHSA-2021:5070 Released 2021-12-09 · Red Hat rating ModerateRed Hat OpenStack Platform 16.1 (python-django20) security update
- Red Hat OpenStack Platform 16.1 python-django20-2.0.13-16.el8ost.1, python-django20-bash-completion-2.0.13-16.el8ost.1, python3-django20-2.0.13-16.el8ost.1
- RHSA-2021:3490 Released 2021-09-15 · Red Hat rating ModerateRed Hat OpenStack Platform 16.2 (python-django20) security update
- Red Hat OpenStack Platform 16.2 python-django20-2.0.13-16.el8ost.1, python3-django20-2.0.13-16.el8ost.1
- RHSA-2021:0781 Released 2021-03-09 · Red Hat rating ModerateRed Hat Ansible Automation Platform 1.2.2 security and bug fix update
- Red Hat Automation Hub 4.2 for RHEL 7 automation-hub-4.2.2-1.el7pc, python-bleach-3.3.0-1.el7pc, python-bleach-allowlist-1.0.3-1.el7pc +9
- Red Hat Automation Hub 4.2 for RHEL 8 automation-hub-4.2.2-1.el8pc, python-bleach-3.3.0-1.el8pc, python-bleach-allowlist-1.0.3-1.el8pc +9
Show 1 more Red Hat advisories
- RHSA-2021:0780 Released 2021-03-09 · Red Hat rating ImportantRed Hat Ansible Tower 3.8.2-1 - Container security and bug fix update
- Red Hat Ansible Tower 3.8 for RHEL 7 ansible-tower-38/ansible-runner-rhel7, ansible-tower-38/ansible-tower-rhel7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 1.2 | Affected | No fix yet |
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Storage 3 | Affected | No fix yet: Fix deferred |
| Red Hat Update Infrastructure 3 for Cloud Providers | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Tower 3.8 for RHEL 7 | Fixed | RHSA-2021:0780 |
| Red Hat Automation Hub 4.2 for RHEL 7 | Fixed | RHSA-2021:0781 |
| Red Hat Automation Hub 4.2 for RHEL 8 | Fixed | RHSA-2021:0781 |
| Red Hat OpenStack Platform 16.1 | Fixed | RHSA-2021:5070 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2021:3490 |
Not affected: 1 product
- Red Hat Ansible Tower 3
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3281
- 2026-10-03 Alias added: GHSA-fvgf-6h6h-3322
References
Advisory 5
Other 13
- https://groups.google.com/forum/#%21forum/django-announce
- https://github.com/django/django/commit/02e6592835b4559909aa3aaaf67988fef435f624
- https://github.com/django/django/commit/05413afa8c18cdb978fcdf470e09f7a12b234a23
- https://github.com/django/django/commit/21e7622dec1f8612c85c2fc37fe8efbfd3311e37
- https://github.com/django/django/commit/52e409ed17287e9aabda847b6afe58be2fa9f86a
- https://docs.djangoproject.com/en/3.1/releases/3.0.12
- https://docs.djangoproject.com/en/3.1/releases/security
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2021-9.yaml
- https://groups.google.com/forum/#!forum/django-announce
- https://lists.fedoraproject.org/archives/list/[email protected]/message/YF52FKEH5S2P5CM4X7IXSYG67YY2CDOO
- https://security.netapp.com/advisory/ntap-20210226-0004
- https://www.djangoproject.com/weblog/2021/feb/01/security-releases
Sources
- CVE-2021-3281 · CVE Program
- CVE-2021-3281 · NVD
- FIRST EPSS
- GHSA-fvgf-6h6h-3322 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-3281 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences