3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-59682

CVE-2025-59682: Django vulnerable to partial directory traversal via archives

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-59682

CVE-2025-59682:

3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
django	pip	>= 4.2, < 4.2.25	4.2.25
django	pip	>= 5.1, < 5.1.13	5.1.13
django	pip	>= 5.2, < 5.2.7	5.2.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability, identified as CVE-2025-59682, is a partial directory traversal flaw within the django.utils.archive.extract() function. This function is utilized by the startapp --template and startproject --template management commands in Django. The root cause of the vulnerability is an inadequate path validation check in the Archive.target_filename method, located in django/utils/archive.py. The original implementation relied on filename.startswith(target_path) to ensure that files were extracted into the intended directory. This check could be bypassed by crafting an archive containing file paths that share a common prefix with the target directory, but then traverse upwards (e.g., .../target_dir_suffix/../malicious_file). The patch, found in commit 924a0c092e65fa2d0953fd1855d2dc8786d94de2, rectifies this by replacing the startswith check with os.path.commonpath(). This ensures that the resolved path of the file to be extracted is strictly within the boundaries of the target extraction directory. During exploitation, a call to django.utils.archive.extract() would be made, which in turn calls the Archive.target_filename method where the faulty logic resided. Therefore, both extract and Archive.target_filename are the key functions that would appear in a runtime profile when this vulnerability is triggered.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.