Django Directory Traversal Vulnerability in Archive Extraction

A partial directory traversal vulnerability has been identified in Django versions 4.2 prior to 4.2.25, 5.1 prior to 5.1.13, and 5.2 prior to 5.2.7. The issue arises in the 'django.utils.archive.extract()' function, which is utilized by the 'startapp --template' and 'startproject --template' commands. The vulnerability allows an archive containing file paths that share a common prefix with the target directory to traverse directories partially, potentially leading to unauthorized file extraction.

Impact

Exploitation of this vulnerability could result in partial directory traversal, allowing files to be extracted from locations outside the intended directory.

Reproduction

To reproduce this vulnerability, create an archive file that includes file paths sharing a common prefix with the target extraction directory. Then, use the 'startapp --template' or 'startproject --template' commands to extract the archive. The 'django.utils.archive.extract()' function will process the archive, leading to partial directory traversal.

Remediation

Users can upgrade to Django versions 5.2.7, 5.1.13, or 4.2.25 to address this vulnerability.