CVE-2025-59682

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.24 Django versions 5.1 through 5.1.12 Django versions 5.2 through 5.2.6

Description The django.utils.archive.extract() function allows for potential directory traversal when handling archives with file paths that share a common prefix with the target directory. This issue affects the "startapp --template" and "startproject --template" commands.

Recommendations Update to Django version 4.2.25 or later. Update to Django version 5.1.13 or later. Update to Django version 5.2.7 or later.