CVE-2021-45452: Djangoproject Django

Medium severity, CVSS 5.3. EPSS: 2.4% chance of exploitation in the next 30 days.

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.

Affected products

• Djangoproject Django: from 2.2, before 2.2.26 (fixed in 2.2.26); from 3.2, before 3.2.11 (fixed in 3.2.11); from 4.0, before 4.0.1 (fixed in 4.0.1)
• Fedoraproject Fedora: version 35 only

Published 2022-01-05. Last modified 2026-06-17.