CVE-2025-59682: Django Path Traversal Vulnerability

CVE-2025-59682 Overview

CVE-2025-59682 is a partial directory traversal vulnerability in the Django web framework. The flaw resides in the django.utils.archive.extract() function, which is invoked by the startapp --template and startproject --template management commands. An attacker who supplies a crafted archive can write files outside the intended target directory when the malicious paths share a common prefix with that directory. The issue affects Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The vulnerability is classified under [CWE-23: Relative Path Traversal].

Critical Impact
Attackers can place files in adjacent directories on the host running Django management commands that consume attacker-supplied templates.

Affected Products

Django 4.2 versions prior to 4.2.25
Django 5.1 versions prior to 5.1.13
Django 5.2 versions prior to 5.2.7

Discovery Timeline

2025-10-01 - Django project publishes security release addressing the issue
2025-10-01 - CVE-2025-59682 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59682

Vulnerability Analysis

The vulnerability affects Django's internal archive extraction helper used to expand project and application templates. When a developer runs django-admin startproject --template=<archive> or django-admin startapp --template=<archive>, Django downloads and extracts the archive into the target directory. The extractor validates that each archive member's destination begins with the target directory path but performs the check using a string prefix comparison rather than a full path component comparison. This allows a member named, for example, projectname_evil/malicious.py to bypass the check when the target directory is projectname, resulting in a file written to a sibling directory. The impact is limited to confidentiality of adjacent filesystem contents and unauthorized write locations rather than full arbitrary filesystem write.

Root Cause

The root cause is improper path validation inside django.utils.archive.extract(). The function compares the resolved archive member destination against the target directory using a naive string startswith comparison. Because sibling paths can share a textual prefix with the target directory, the boundary check fails to enforce a true directory containment invariant.

Attack Vector

Exploitation requires a developer or automated pipeline to run startapp or startproject against an attacker-controlled template archive. The archive is typically fetched from a URL or local path passed on the command line. An attacker who controls the archive contents can craft entries whose paths share the prefix of the intended output directory, causing the extractor to write files to adjacent directories on the local filesystem. No authentication to a Django application is required; the trust boundary is the archive source consumed by the tooling.

No verified public proof-of-concept code is available for this issue. Refer to the Django Weblog Security Releases and the Openwall OSS Security Mailing List for the upstream technical description.

Detection Methods for CVE-2025-59682

Indicators of Compromise

Files written to directories adjacent to a startproject or startapp target directory shortly after a template extraction command was executed.
Unexpected Python source files, configuration files, or scripts appearing in sibling directories that share a name prefix with a newly created Django project.
Shell history or CI logs showing django-admin startproject --template= or startapp --template= invocations against untrusted URLs or archives.

Detection Strategies

Inventory installed Django versions across developer workstations, build agents, and container images, and flag any version below 4.2.25, 5.1.13, or 5.2.7.
Audit continuous integration pipelines and developer tooling for uses of --template flags that reference external URLs or user-supplied archives.
Enable filesystem auditing on directories that host Django project scaffolding to record file creation events during template extraction.

Monitoring Recommendations

Alert on django-admin or manage.py process executions that include --template arguments referencing remote URLs.
Monitor package management events that install or upgrade the django distribution to confirm patched versions are deployed.
Track outbound network connections from developer and CI hosts to archive-hosting domains used with Django template commands.

How to Mitigate CVE-2025-59682

Immediate Actions Required

Upgrade Django to 4.2.25, 5.1.13, or 5.2.7 or later, depending on the release branch in use.
Stop invoking startapp --template or startproject --template against untrusted archive sources until all systems are patched.
Review recent template-based project scaffolding activity and inspect adjacent directories for unexpected files.

Patch Information

The Django security team released fixed versions on 2025-10-01. Full remediation details, changelogs, and download links are available in the Django Security Release Notes and the Django Weblog Security Releases announcement. Subscribers can also track disclosures via the Django Announcements Group.

Workarounds

Restrict template archive sources to trusted, internally hosted repositories with integrity verification.
Execute template extraction commands inside isolated, ephemeral containers or sandboxes so any stray files are discarded.
Inspect archive contents with a tool such as tar -tvf or unzip -l before passing them to Django management commands.

bash

# Upgrade Django to a patched release matching your branch
pip install --upgrade 'django>=4.2.25,<4.3'   # for 4.2.x deployments
pip install --upgrade 'django>=5.1.13,<5.2'   # for 5.1.x deployments
pip install --upgrade 'django>=5.2.7,<5.3'    # for 5.2.x deployments

# Verify installed version
python -c "import django; print(django.get_version())"