CVE-2021-45452

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jan 5, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-454547.5Ampere Altra before SRP 1.08b and Altra Max​ before SRP 2.05 allow information disclosure of power telemetry via HWmon.CVE-2021-454569.8Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a misCVE-2021-454577.5In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.CVE-2021-454587.5Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm usCVE-2021-454599.8lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter.CVE-2021-454608.1A vulnerability has been identified in SICAM PQ Analyzer (All versions < V3.18). A service is started by an unquoted registry entry. As therCVE-2021-454619.8FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execCVE-2021-454627.5In Open5GS 2.4.0, a crafted packet from UE can crash SGW-U/UPF.CVE-2021-454637.8load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caCVE-2021-454648.8kvmtool through 39181fc allows an out-of-bounds write, related to virtio/balloon.c and virtio/pci.c. This allows a guest OS user to execute CVE-2021-454657.8A vulnerability has been identified in syngo fastView (All versions). The affected application lacks proper validation of user-supplied dataCVE-2021-454669.8In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to a