CVE-2025-59682

MediumCVSS 6.5/10Last modified Oct 12, 2026

Description

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-23

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2025
Last modified: Oct 12, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-596839.1Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office CVE-2025-596848.8DigiSign DigiSigner ONE 1.0.4.60 allows DLL Hijacking.CVE-2025-596855.3Kazaar 1.25.12 allows a JWT with none in the alg field.CVE-2025-596866.5Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id.CVE-2025-596874.3IMPAQTR Aurora before 1.36 allows Insecure Direct Object Reference attacks against the users list, organization details, bookmarks, and noti CVE-2025-596896.1Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been release CVE-2025-59698.8A vulnerability has been found in D-Link DIR-632 FW103B08 and classified as critical. Affected by this vulnerability is the function FUN_004 CVE-2025-596913.7PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel upon network events such as Wi CVE-2025-596923.7PureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's existing iptables rules and apply CVE-2025-596939.8The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) CVE-2025-596946.8The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) CVE-2025-596959.8Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a user