CVE-2021-45452

Name of the Vulnerable Software and Affected Versions Django versions 2.2 through 2.2.25 Django versions 3.2 through 3.2.10 Django versions 4.0 through 4.0.0

Description The issue is related to the Storage.save() function in the Django web application framework, which is associated with incorrect restriction of the path name to a limited directory, allowing directory traversal. This can be exploited by a remote attacker to access confidential information by sending a specially crafted HTTP file to the application. The vulnerability can be exploited by passing crafted filenames directly to the Storage.save() function, allowing an attacker to write files outside the intended directory.

Recommendations For Django versions 2.2 through 2.2.25, update to version 2.2.26 or later. For Django versions 3.2 through 3.2.10, update to version 3.2.11 or later. For Django versions 4.0 through 4.0.0, update to version 4.0.1 or later. As a temporary workaround, consider restricting access to the Storage.save() function to minimize the risk of exploitation.