CVE-2025-59682

score

<0.1

cvss

3.1

epss

0.9%

published

2025-10-01

kev added

—

first seen

2026-10-21

Django 4.2 < 4.2.25, 5.1 < 5.1.13, and 5.2 < 5.2.7 contain a path traversal vulnerability caused by improper handling of archive file paths in django.utils.archive.extract(), letting attackers perform partial directory traversal via crafted archives, exploit requires use of startapp or startproject commands with templates.