AIKIDO-2025-10101
django-storages is vulnerable to Path Traversal
83
High Risk
This Affects:
django-storagesTL;DR
Affected versions of this package are vulnerable to path traversal due to an improper override of get_available_name, which Django relies on for security. This issue, originally addressed in CVE-2024-39330, was reintroduced by the overridden implementation in this library. The vulnerability is fixed in version 4.2 and later.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
django-storages is vulnerable to Path Traversal in versions 1.7 - 1.14.4.
How to fix this
Upgrade the django-storages library to the patch version.
Links
github.com/jschneier/django-storages/blob/master/CHANGELOG.rst
docs.djangoproject.com/en/dev/releases/security/groups.google.com/forum/#%21forum/django-announcedjangoproject.com/weblog/2024/jul/09/security-releases/security.netapp.com/advisory/ntap-20240808-0005/
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.