Listen to this Post
The vulnerability resides in the `django.utils.archive.extract()` function, which is utilized by the `startapp –template` and `startproject –template` management commands. This function is responsible for extracting user-supplied archive files (like .tar or .zip) that serve as project or application templates. The flaw enables a partial directory traversal attack. When an archive contains a file entry whose path begins with the same common prefix as the intended target directory, the extraction logic can be manipulated. For instance, if the target is /app/myproject_template, a malicious archive entry named `/app/myproject_template/../sensitive_file` could be used. The function’s path sanitization checks are insufficient, allowing the entry to escape the designated subdirectory. This results in the file being written to a parent directory adjacent to the target, rather than being safely contained within it, leading to a partial overwrite of files outside the intended extraction base.
Platform: Django
Version: 4.2-5.2
Vulnerability : Directory Traversal
Severity: Low
date: 2025-10-01
Prediction: 2025-10-15
What Undercode Say:
python manage.py startapp myapp --template malicious.tar.gz
Example of a malicious tar entry structure
Target directory: /tmp/django_project/
Malicious entry path: /tmp/django_project/../../etc/passwd
import tarfile
with tarfile.open('malicious.tar.gz', 'w:gz') as tar:
info = tarfile.TarInfo(name='../../etc/passwd')
tar.addfile(info)
How Exploit:
Craft archive with paths using `../` after a valid prefix.
Extract via startapp/startproject commands.
Overwrite files adjacent to target.
Protection from this CVE
Update to patched versions.
Validate archive paths strictly.
Use virtual environments.
Impact:
Partial file overwrite.
Limited system modification.
Integrity loss.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
