CVE-2013-4315: Djangoproject Django

Medium severity, CVSS 5.0. EPSS: 3.2% chance of exploitation in the next 30 days.

Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a .. (dot dot) in a ssi template tag.

Affected products

• Djangoproject Django: version 1.4 only; version 1.4.1 only; version 1.4.2 only; version 1.4.4 only; version 1.4.5 only; version 1.4.6 only; …

Published 2013-09-16. Last modified 2026-06-16.