CVE catalog

CVE-2021-45452

python-django: CVE-2021-45452

[CVE catalog]

Severity
High · CVSS 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.41% · Oct 25, 2026

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython-djangosid3:5.2.18-1fixed
Debianpython-djangoforky3:5.2.17-2fixed
Debianpython-djangotrixie3:4.2.28-0+deb13u2fixed
Debianpython-djangotrixie-security3:4.2.28-0+deb13u1fixed
Debianpython-djangobookworm3:3.2.25-0+deb12u3fixed
Debianpython-djangobookworm-security3:3.2.25-0+deb12u6fixed
Ubuntupython-djangopro1.7.9-1ubuntu5vulnerable
Ubuntupython-djangopro1.8.5-2ubuntu1vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu1vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu2vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu3vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu4vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.1vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.2vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.4vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.5vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.6vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.7vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.8vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.9vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.10vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.11vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.12vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.13vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.14vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.15vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.15+esm1vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.15+esm3vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.15+esm4vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.15+esm5vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.15+esm6vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.15+esm7vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.15+esm8vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.15+esm9vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.15+esm10vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.15+esm11vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.15+esm12vulnerable
Ubuntupython-djangopro1.8.7-1ubuntu5.15+esm13vulnerable
Ubuntupython-django18.041:1.11.4-1ubuntu1vulnerable
Ubuntupython-django18.041:1.11.6-1ubuntu1vulnerable
Ubuntupython-django18.041:1.11.9-1ubuntu1vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.1vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.2vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.3vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.4vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.5vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.6vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.7vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.8vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.9vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.10vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.11vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.12vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.13vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.14vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.15fixed
Ubuntupython-django20.041:1.11.22-1ubuntu1vulnerable
Ubuntupython-django20.042:2.2.6-1ubuntu1vulnerable
Ubuntupython-django20.042:2.2.9-2ubuntu1vulnerable
Ubuntupython-django20.042:2.2.10-1vulnerable
Ubuntupython-django20.042:2.2.10-1ubuntu1vulnerable
Ubuntupython-django20.042:2.2.11-1vulnerable
Ubuntupython-django20.042:2.2.12-1vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.1vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.2vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.3vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.4vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.5vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.6vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.7vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.8vulnerable
Ubuntupython-django20.042:2.2.12-1ubuntu0.9fixed
Susepython-Djangohpe helion openstack 81.11.29-3.39.1fixed
Susevenv-openstack-aodhhpe helion openstack 85.1.1~dev7-12.37.1fixed
Susevenv-openstack-barbicanhpe helion openstack 85.0.2~dev3-12.38.1fixed
Susevenv-openstack-ceilometerhpe helion openstack 89.0.8~dev7-12.35.1fixed
Susevenv-openstack-cinderhpe helion openstack 811.2.3~dev29-14.39.1fixed
Susevenv-openstack-designatehpe helion openstack 85.0.3~dev7-12.36.1fixed
Susevenv-openstack-freezerhpe helion openstack 85.0.0.0~xrc2~dev2-10.33.1fixed
Susevenv-openstack-glancehpe helion openstack 815.0.3~dev3-12.36.1fixed
Susevenv-openstack-heathpe helion openstack 89.0.8~dev22-12.40.1fixed
Susevenv-openstack-horizon-hpehpe helion openstack 812.0.5~dev6-14.43.2fixed
Susevenv-openstack-ironichpe helion openstack 89.1.8~dev8-12.38.1fixed
Susevenv-openstack-keystonehpe helion openstack 812.0.4~dev11-11.40.1fixed
Susevenv-openstack-magnumhpe helion openstack 85.0.2_5.0.2_5.0.2~dev31-11.37.1fixed
Susevenv-openstack-manilahpe helion openstack 85.1.1~dev5-12.42.1fixed
Susevenv-openstack-monascahpe helion openstack 82.2.2~dev1-11.40.1fixed
Susevenv-openstack-monasca-ceilometerhpe helion openstack 81.5.1_1.5.1_1.5.1~dev3-8.33.1fixed
Susevenv-openstack-muranohpe helion openstack 84.0.2~dev2-12.33.1fixed
Susevenv-openstack-neutronhpe helion openstack 811.0.9~dev69-13.43.1fixed
Susevenv-openstack-novahpe helion openstack 816.1.9~dev92-11.41.1fixed
Susevenv-openstack-octaviahpe helion openstack 81.0.6~dev3-12.38.1fixed
Susevenv-openstack-saharahpe helion openstack 87.0.5~dev4-11.37.1fixed
Susevenv-openstack-swifthpe helion openstack 82.15.2_2.15.2_2.15.2~dev32-11.28.1fixed
Susevenv-openstack-trovehpe helion openstack 88.0.2~dev2-11.37.1fixed
Susepython-Djangoopenstack cloud 81.11.29-3.39.1fixed
Susevenv-openstack-aodhopenstack cloud 85.1.1~dev7-12.37.1fixed
Susevenv-openstack-barbicanopenstack cloud 85.0.2~dev3-12.38.1fixed
Susevenv-openstack-ceilometeropenstack cloud 89.0.8~dev7-12.35.1fixed
Susevenv-openstack-cinderopenstack cloud 811.2.3~dev29-14.39.1fixed
Susevenv-openstack-designateopenstack cloud 85.0.3~dev7-12.36.1fixed
Susevenv-openstack-freezeropenstack cloud 85.0.0.0~xrc2~dev2-10.33.1fixed
Susevenv-openstack-glanceopenstack cloud 815.0.3~dev3-12.36.1fixed
Susevenv-openstack-heatopenstack cloud 89.0.8~dev22-12.40.1fixed
Susevenv-openstack-horizonopenstack cloud 812.0.5~dev6-14.43.2fixed
Susevenv-openstack-ironicopenstack cloud 89.1.8~dev8-12.38.1fixed
Susevenv-openstack-keystoneopenstack cloud 812.0.4~dev11-11.40.1fixed
Susevenv-openstack-magnumopenstack cloud 85.0.2_5.0.2_5.0.2~dev31-11.37.1fixed
Susevenv-openstack-manilaopenstack cloud 85.1.1~dev5-12.42.1fixed
Susevenv-openstack-monascaopenstack cloud 82.2.2~dev1-11.40.1fixed
Susevenv-openstack-monasca-ceilometeropenstack cloud 81.5.1_1.5.1_1.5.1~dev3-8.33.1fixed
Susevenv-openstack-muranoopenstack cloud 84.0.2~dev2-12.33.1fixed
Susevenv-openstack-neutronopenstack cloud 811.0.9~dev69-13.43.1fixed
Susevenv-openstack-novaopenstack cloud 816.1.9~dev92-11.41.1fixed
Susevenv-openstack-octaviaopenstack cloud 81.0.6~dev3-12.38.1fixed
Susevenv-openstack-saharaopenstack cloud 87.0.5~dev4-11.37.1fixed
Susevenv-openstack-swiftopenstack cloud 82.15.2_2.15.2_2.15.2~dev32-11.28.1fixed
Susevenv-openstack-troveopenstack cloud 88.0.2~dev2-11.37.1fixed
Susepython-Djangoopenstack cloud crowbar 81.11.29-3.39.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython-djangosourcesid2:3.2.11-1not yet assignedNot reported[1003113]
Debianpython-djangosourceforky2:3.2.11-1not yet assignedNot reported[1003113]
Debianpython-djangosourcetrixie2:3.2.11-1not yet assignedNot reported[1003113]
Debianpython-djangosourcebookworm2:3.2.11-1not yet assignedNot reported[1003113]
Ubuntupython-djangodeb18.041:1.11.11-1ubuntu1.15Not reportedUBUNTU-CVE-2021-45452Not reported
Ubuntupython-djangodeb20.042:2.2.12-1ubuntu0.9Not reportedUBUNTU-CVE-2021-45452Not reported
Susepython-Djangorpmhpe helion openstack 81.11.29-3.39.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-aodhrpmhpe helion openstack 85.1.1~dev7-12.37.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-barbicanrpmhpe helion openstack 85.0.2~dev3-12.38.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-ceilometerrpmhpe helion openstack 89.0.8~dev7-12.35.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-cinderrpmhpe helion openstack 811.2.3~dev29-14.39.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-designaterpmhpe helion openstack 85.0.3~dev7-12.36.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-freezerrpmhpe helion openstack 85.0.0.0~xrc2~dev2-10.33.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-glancerpmhpe helion openstack 815.0.3~dev3-12.36.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-heatrpmhpe helion openstack 89.0.8~dev22-12.40.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-horizon-hperpmhpe helion openstack 812.0.5~dev6-14.43.2Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-ironicrpmhpe helion openstack 89.1.8~dev8-12.38.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-keystonerpmhpe helion openstack 812.0.4~dev11-11.40.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-magnumrpmhpe helion openstack 85.0.2_5.0.2_5.0.2~dev31-11.37.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-manilarpmhpe helion openstack 85.1.1~dev5-12.42.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-monascarpmhpe helion openstack 82.2.2~dev1-11.40.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-monasca-ceilometerrpmhpe helion openstack 81.5.1_1.5.1_1.5.1~dev3-8.33.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-muranorpmhpe helion openstack 84.0.2~dev2-12.33.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-neutronrpmhpe helion openstack 811.0.9~dev69-13.43.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-novarpmhpe helion openstack 816.1.9~dev92-11.41.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-octaviarpmhpe helion openstack 81.0.6~dev3-12.38.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-sahararpmhpe helion openstack 87.0.5~dev4-11.37.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-swiftrpmhpe helion openstack 82.15.2_2.15.2_2.15.2~dev32-11.28.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-troverpmhpe helion openstack 88.0.2~dev2-11.37.1Not reportedSUSE-SU-2022:0286-1Not reported
Susepython-Djangorpmopenstack cloud 81.11.29-3.39.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-aodhrpmopenstack cloud 85.1.1~dev7-12.37.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-barbicanrpmopenstack cloud 85.0.2~dev3-12.38.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-ceilometerrpmopenstack cloud 89.0.8~dev7-12.35.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-cinderrpmopenstack cloud 811.2.3~dev29-14.39.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-designaterpmopenstack cloud 85.0.3~dev7-12.36.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-freezerrpmopenstack cloud 85.0.0.0~xrc2~dev2-10.33.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-glancerpmopenstack cloud 815.0.3~dev3-12.36.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-heatrpmopenstack cloud 89.0.8~dev22-12.40.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-horizonrpmopenstack cloud 812.0.5~dev6-14.43.2Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-ironicrpmopenstack cloud 89.1.8~dev8-12.38.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-keystonerpmopenstack cloud 812.0.4~dev11-11.40.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-magnumrpmopenstack cloud 85.0.2_5.0.2_5.0.2~dev31-11.37.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-manilarpmopenstack cloud 85.1.1~dev5-12.42.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-monascarpmopenstack cloud 82.2.2~dev1-11.40.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-monasca-ceilometerrpmopenstack cloud 81.5.1_1.5.1_1.5.1~dev3-8.33.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-muranorpmopenstack cloud 84.0.2~dev2-12.33.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-neutronrpmopenstack cloud 811.0.9~dev69-13.43.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-novarpmopenstack cloud 816.1.9~dev92-11.41.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-octaviarpmopenstack cloud 81.0.6~dev3-12.38.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-sahararpmopenstack cloud 87.0.5~dev4-11.37.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-swiftrpmopenstack cloud 82.15.2_2.15.2_2.15.2~dev32-11.28.1Not reportedSUSE-SU-2022:0286-1Not reported
Susevenv-openstack-troverpmopenstack cloud 88.0.2~dev2-11.37.1Not reportedSUSE-SU-2022:0286-1Not reported
Susepython-Djangorpmopenstack cloud crowbar 81.11.29-3.39.1Not reportedSUSE-SU-2022:0286-1Not reported

[Debian bug #1003113]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • Source package: [python-django]

    Details (6)
    • 3:3.2.25-0+deb12u3 · all · bookworm

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:3.2.25-0+deb12u3 · all · bookworm

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:4.2.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:4.2.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:3.2.25-0+deb12u4 · all · bookworm-security

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:3.2.25-0+deb12u4 · all · bookworm-security

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

  • Source package: [python-django]

    Details (6)
    • 3:3.2.25-0+deb12u3 · all · bookworm

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:3.2.25-0+deb12u3 · all · bookworm

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:4.2.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:4.2.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:3.2.25-0+deb12u4 · all · bookworm-security

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:3.2.25-0+deb12u4 · all · bookworm-security

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

[Debian 13 (Trixie)]

  • Source package: [python-django]

    Details (6)
    • 3:4.2.28-0+deb13u2 · all · trixie

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · 13

    • 3:4.2.28-0+deb13u2 · all · trixie

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · 13

    • 3:5.2.16-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · 13

    • 3:5.2.16-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · 13

    • 3:4.2.28-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · 13

    • 3:4.2.28-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · 13

  • Source package: [python-django]

    Details (6)
    • 3:4.2.28-0+deb13u2 · all · trixie

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · 13

    • 3:4.2.28-0+deb13u2 · all · trixie

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · 13

    • 3:5.2.16-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · 13

    • 3:5.2.16-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · 13

    • 3:4.2.28-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · 13

    • 3:4.2.28-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 2:3.2.11-1

      dsa · python-django · debian · 13

Observed:

References